]> git.ipfire.org Git - thirdparty/openssl.git/commitdiff
Avoid creating TLSProxy on IPv6 loopback address is IPv6 is disabled
authorEugene Syromiatnikov <esyr@openssl.org>
Thu, 26 Mar 2026 04:52:40 +0000 (05:52 +0100)
committerNorbert Pocs <norbertp@openssl.org>
Wed, 15 Apr 2026 12:44:58 +0000 (14:44 +0200)
Add a parameter to TLSProxy::Proxy->new()
and TLSProxy::Proxy->new_dtls() that indicates IPv6 usage preference
and pass have_IPv6() to it, so IPv6 usage is avoided when it is disabled.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:33 2026
(Merged from https://github.com/openssl/openssl/pull/30580)

27 files changed:
test/recipes/70-test_certtypeext.t
test/recipes/70-test_comp.t
test/recipes/70-test_expected_rpk.t
test/recipes/70-test_key_share.t
test/recipes/70-test_npn.t
test/recipes/70-test_renegotiation.t
test/recipes/70-test_sslcbcpadding.t
test/recipes/70-test_sslcertstatus.t
test/recipes/70-test_sslextension.t
test/recipes/70-test_sslmessages.t
test/recipes/70-test_sslrecords.t
test/recipes/70-test_sslsessiontick.t
test/recipes/70-test_sslsigalgs.t
test/recipes/70-test_sslsignature.t
test/recipes/70-test_sslskewith0p.t
test/recipes/70-test_sslversions.t
test/recipes/70-test_sslvertol.t
test/recipes/70-test_tls13alerts.t
test/recipes/70-test_tls13certcomp.t
test/recipes/70-test_tls13cookie.t
test/recipes/70-test_tls13downgrade.t
test/recipes/70-test_tls13hrr.t
test/recipes/70-test_tls13kexmodes.t
test/recipes/70-test_tls13messages.t
test/recipes/70-test_tls13psk.t
test/recipes/70-test_tlsextms.t
util/perl/TLSProxy/Proxy.pm

index cdfc5ae7cc19ee672e925bcad8e4e6e59499e381..a310524ee89b11ea88269ae1304fe1ec29a2ad59 100644 (file)
@@ -33,7 +33,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&certtype_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index 2e4b288e51e5d8d60c9fccac1fa5fdd3a1413f66..c8e37f4cc32c636c96dce5557b525c5a60539517 100644 (file)
@@ -85,7 +85,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
index 1fb3a67ca66b74897559f5d69254fc962d127488..5165ed92634907eea781a16631fcb2f297e72d48 100644 (file)
@@ -32,7 +32,8 @@ my $proxy = TLSProxy::Proxy->new(
     sub { return; },
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 SKIP: {
index 812023252a02a8e8868adf0caabbdcda0325ed79..afd769c9b064767186922cd90106c1077d9a7aef 100644 (file)
@@ -73,7 +73,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #We assume that test_ssl_new and friends will test the happy path for this,
index e1d058dbb63a7aa773ca3a8ba509e28ce81ab1e7..13ac6fc48d8cca9e371aef7a350947fa4e5fa739 100644 (file)
@@ -36,7 +36,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 $proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
index 4a8728e2f6da2d6419a533c3d0d0553e521298cd..d0ab0fcbe14fad17cbac61b98ce8ef64cc8a9101 100644 (file)
@@ -36,7 +36,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 sub success_or_closenotify
index 83fc8ab91cd819bc9aa22da3887430f1bdb3f00b..29b35baf39e425046c4a5acadef2e4b2829962c7 100644 (file)
@@ -35,7 +35,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&add_maximal_padding_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 # TODO: We could test all 256 values, but then the log file gets too large for
index c6aca567f71c609e5cebd1a947aa587f5c9e0a97..4c384ff49efed55335fb3413611498c23af5d85f 100644 (file)
@@ -37,7 +37,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&certstatus_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Test 1: Sending a status_request extension in both ClientHello and
index 31e494134a81a760a026699c8b7e18d1329b5f01..3327df474e1be0b4d84be187ab3206ee1a58a38a 100644 (file)
@@ -48,7 +48,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&inject_duplicate_extension_clienthello,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 
index e34909fcf0af84ddc2101d04b9bce7f7d0b560fc..3b2756de8b04d8c2d979d28397fdd53bb2f8a3ca 100644 (file)
@@ -36,7 +36,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 @handmessages = (
index 5ab746f4b750fbc67b27645dce681d83280796c5..093cbf70656340808d67b355e9dad7b6b4bf6497 100644 (file)
@@ -59,14 +59,16 @@ sub run_tests
             \&add_empty_recs_filter,
             cmdstr(app([ "openssl" ]), display => 1),
             srctop_file("apps", "server.pem"),
-            (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+            (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+            have_IPv6()
         );
     } else {
         $proxy = TLSProxy::Proxy->new(
             \&add_empty_recs_filter,
             cmdstr(app([ "openssl" ]), display => 1),
             srctop_file("apps", "server.pem"),
-            (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+            (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+            have_IPv6()
         );
     }
 
index 59bd677d53562bdb0da4ceff929e2b67b53fc033..8ebbbf2cb92c824bcf8c87b483b6832108b65e89 100644 (file)
@@ -43,7 +43,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Test 1: By default with no existing session we should get a session ticket
index 3d0b55fc714cf4c3b2e73dcb1ffb5e78013c377a..c4c22df06ebe379f81182bcd0fb4956f6df5eea6 100644 (file)
@@ -33,7 +33,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index 0d1b3584e9614810a54038775aacbeee36dd74c8..27a1ad5f7f5825068c67f1a5ea948a51db3d97be 100644 (file)
@@ -33,7 +33,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index 49f26c1cab926f5337b493299a516a2b4db037fa..8b6569a5f4e7c74d2b1e3e3b99d59bc8cc948fa1 100644 (file)
@@ -36,7 +36,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&ske_0_p_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #We must use an anon DHE cipher for this test
index e9c2d4ff2cf467440249c6f62c791b2cac8e74a8..6ec62ab4af414b7124965069ccefaf738da7ce8e 100644 (file)
@@ -49,7 +49,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #We're just testing various negative and unusual scenarios here. ssltest with
index 7ae56229db38b56d514410598c1952ad92e78447..8462818ac225f4b6aa963fe80c14b61e91c09409 100644 (file)
@@ -33,7 +33,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&vers_tolerance_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 my @available_tls_versions = ();
index 1858a8d4f2c61b27c4839a822cef7287904ff33c..a3849ccc3675cd7a24e16b696cfc238e43d73fd4 100644 (file)
@@ -33,7 +33,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Test 1: We test that a server can handle an unencrypted alert when normally the
index cd40fca24fe001886255d17be22d01fec9625cc0..f58c285281fb09c5e5b5d936ab2f0335b19a5c5f 100644 (file)
@@ -214,7 +214,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 
index e1c65f2fa4d15483eab70ea02d34a31e949ee134..dfbe7edc33d326539121a21735cfaa0f136cd913 100644 (file)
@@ -38,7 +38,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 my $cookieseen = 0;
index 6802fbc8ecfbbf23ea39b289ea0a2041bc3eb46b..7d750a292bc2fa096eb2236794d6f47069650a71 100644 (file)
@@ -34,7 +34,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index 0ed006a167f9ee0800cc513b4eadbcc8597c7ed5..ff2f6dbdd18762532268f7f55623654d22004de3 100644 (file)
@@ -34,7 +34,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index 203f50632660277fbd82b06147cc24dd6d3901f6..685adcd5a966b24c001bd9092b1538ecbeb7797b 100644 (file)
@@ -193,7 +193,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Test 1: First get a session
index 059f1b466ce6279f04ca174ab022eb38f2dbbeee..f3a3f4789f9c06b33482ad272d22fa896ba15fc1 100644 (file)
@@ -208,7 +208,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Test 1: Check we get all the right messages for a default handshake
index 3de688ec74f100cd2180477dc0d609536a13dc8e..83ce3b1ef1390dcdc35a62dc3b2ef74f7a0af63d 100644 (file)
@@ -34,7 +34,8 @@ my $proxy = TLSProxy::Proxy->new(
     undef,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 use constant {
index feccd5a8888eac1aec483f11e332486c7504732e..0e5f5d44b86d2f974dc902c37d647dfaa5eb66a2 100644 (file)
@@ -44,7 +44,8 @@ my $proxy = TLSProxy::Proxy->new(
     \&extms_filter,
     cmdstr(app(["openssl"]), display => 1),
     srctop_file("apps", "server.pem"),
-    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE})
+    (!$ENV{HARNESS_ACTIVE} || $ENV{HARNESS_VERBOSE}),
+    have_IPv6()
 );
 
 #Note that EXTMS is only relevant for <TLS1.3
index 52b9117960ac3b64e31ead7655628de0bebc0597..eccdc98cf69f73c22e7f42322b10ec97df999a4c 100644 (file)
@@ -82,8 +82,9 @@ sub new {
     my ($filter,
         $execute,
         $cert,
-        $debug) = @_;
-    return init($class, $filter, $execute, $cert, $debug, 0);
+        $debug,
+        $use_IPv6) = @_;
+    return init($class, $filter, $execute, $cert, $debug, 0, $use_IPv6);
 }
 
 sub new_dtls {
@@ -91,8 +92,9 @@ sub new_dtls {
     my ($filter,
         $execute,
         $cert,
-        $debug) = @_;
-    return init($class, $filter, $execute, $cert, $debug, 1);
+        $debug,
+        $use_IPv6) = @_;
+    return init($class, $filter, $execute, $cert, $debug, 1, $use_IPv6);
 }
 
 sub init
@@ -119,7 +121,9 @@ sub init
         $execute,
         $cert,
         $debug,
-        $isdtls) = @_;
+        $isdtls,
+        $use_IPv6) = @_;
+    $use_IPv6 //= $have_IPv6;
 
     my $test_client_port;
 
@@ -128,12 +132,12 @@ sub init
     # this test to fail, so lets harden ourselves against that by doing
     # a test bind to the randomly selected port, and only continue once we
     # find a port that's available.
-    my $test_client_addr = $have_IPv6 ? "[::1]" : "127.0.0.1";
+    my $test_client_addr = $use_IPv6 ? "[::1]" : "127.0.0.1";
     my $found_port = 0;
     for (my $i = 0; $i <= 10; $i++) {
         $test_client_port = 49152 + int(rand(65535 - 49152));
         my $test_sock;
-        if ($useINET6 == 0) {
+        if ($use_IPv6 == 0 || $useINET6 == 0) {
             if ($useSockInet == 0) {
                 $test_sock = IO::Socket::IP->new(LocalPort => $test_client_port,
                                                  LocalAddr => $test_client_addr);