Add a CI workflow for no-tls1_2 no-tls1_3 [1.1.1] - #18252
bernd-edlinger wants to merge 6 commits into
Conversation
bernd-edlinger
added
the
branch: 1.1.1
e8c04e0 to
3feab05
Compare
bernd-edlinger
changed the title
bernd-edlinger
changed the title
|
removed WIP, as CI looks good now. |
t8m
added
triaged: bug
488cc24 to
63378d9
Compare
|
This PR is in a state where it requires action by @openssl/otc but the last update was 30 days ago |
63378d9 to
71c3717
Compare
|
This PR is in a state where it requires action by @openssl/otc but the last update was 30 days ago |
Likewise for no-tls1_2 no-ec no-dh Currently these configurations seem to be failing several tests.
Additional to the test failure when neither tls1_2 nor tls1_3 is available, this test chooses a completely unexpected tls1_3 cipher, when tls1_3 is available. It only ever ran correctly so far when only tls1_2 is enabled by configuration: So the not really good case looked like that: Doing handshakes=1 bytes=256 TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, temp key: 253 bits X25519 ../../util/wrap.pl ../../test/ssl_old_test -psk 0102030405 -cipher '@SECLEVEL=2:DHE-PSK-AES128-CCM' => 0 ok 6 - test auto DH meets security strength Fixed that by adding "-client_max_proto tls1.2" to the ssl_old_test command, and executing only when tls1.2 is enabled, but currently this test case is skipped in the enclosing block which is skipped when tls1 is not enabled, so moving this test outside the enclosing block.
Skip tests in 28-seclevel.conf when neither tls1_2 nor tls1_3 are available. Additionally fixed some typos in comments.
We are assuming a ServerKeyExchange message is sent in this test. If we don't have either DH or EC, then it won't be. Skip the failing test in this case.
When configured with no-tls1_2 no-ec no-dh the test/recipes/70-test_clienthello.t starts to fail in the subtest TEST_ADD_PADDING where the TLSEXT_TYPE_padding extension is expected, but the client hello is a few bytes shorter than F5_WORKAROUND_MIN_MSG_LEN (255). Work around that by adding another 80 characters to the alpn_prots.
Currently this configurations seem to be failing.
03281f8 to
6ddcb45
Compare
|
This PR is in a state where it requires action by @openssl/otc but the last update was 61 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 92 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 123 days ago |
|
I think it is too late for this to be merged to 1.1.1. It is not a security nor regression fix. |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 30 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 61 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 92 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 123 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 154 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 185 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 216 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 247 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 278 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 309 days ago |
|
This PR is in a state where it requires action by @openssl/otc but the last update was 340 days ago |
|
1.1.1 is no longer supported. There doesn't seem to be much point keeping this around. |
4 participants
Likewise for no-tls1_2 no-ec no-dh
Currently these configurations seem to be failing several tests.
Checklist