mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-30 23:30:59 +01:00
Code Issues Projects Releases Wiki Activity

REGTEST: quic: add del_ssl_crt-list.vtc new QUIC test

Browse Source 
This new reg test run exactly the same test as reg-test/ssl/del_ssl_crt-list.vtc
but with QUIC connections.

Does not work with OpenSSL 3.5 with such errors:
debug|conn. @(nil) OpenSSL error[0xa0000ea] tls_early_post_process_client_hello: callback failed

Does not work with AWSLC with such errors;
debug|conn. @(nil) OpenSSL error[0x10000085] OPENSSL_internal: CONNECTION_REJECTED
This commit is contained in:
Frederic Lecaille 2025-10-30 14:28:33 +01:00
parent 381eb2411a
commit 097e75f687
3 changed files with 27 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
reg-tests/quic/del_ssl_crt-list.vtc Normal file
View File

@ -0,0 +1,10 @@
#REGTEST_TYPE=devel
# Same test as ssl/del_ssl_crt-list.vtc, but with QUIC connections where applicable (only for TLSv3)
varnishtest "Test the 'del ssl crt-list' feature of the CLI"
feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL) && !feature(OPENSSL_AWSLC) && openssl_version_before(3.5.0)'"
setenv VTC_SOCK_TYPE quic
include ${testdir}/../ssl/del_ssl_crt-list.vtc

1
reg-tests/quic/simple.crt-list Symbolic link
View File

@ -0,0 +1 @@
../ssl/simple.crt-list

21
reg-tests/ssl/del_ssl_crt-list.vtc
View File

@ -18,8 +18,15 @@ server s1 -repeat 2 {
txresp txresp
} -start } -start
setenv -ifunset VTC_SOCK_TYPE stream
haproxy h1 -conf { haproxy h1 -conf {
global global
.if streq("$VTC_SOCK_TYPE",quic)
# required for backend connections
expose-experimental-directives
.endif
.if feature(THREAD) .if feature(THREAD)
thread-groups 1 thread-groups 1
.endif .endif
@ -32,6 +39,10 @@ haproxy h1 -conf {
stats socket "${tmpdir}/h1/stats" level admin stats socket "${tmpdir}/h1/stats" level admin
ssl-default-bind-options strict-sni ssl-default-bind-options strict-sni
#traces
#trace quic sink stderr level developer start now
#trace ssl sink stderr level developer verbosity complete start now
defaults defaults
mode http mode http
option httplog option httplog
@ -47,19 +58,19 @@ haproxy h1 -conf {
bind "fd@${clearlst}" bind "fd@${clearlst}"
balance roundrobin balance roundrobin
http-response set-header X-SSL-Server-SHA1 %[ssl_s_sha1,hex] http-response set-header X-SSL-Server-SHA1 %[ssl_s_sha1,hex]
server s1 "${tmpdir}/first-ssl.sock" ssl verify none sni str(record2.bug940.domain.tld) server s1 "${VTC_SOCK_TYPE}+${h1_ssl_addr}:${h1_ssl_port}" ssl verify none sni str(record2.bug940.domain.tld)
server s2 "${tmpdir}/first-ssl.sock" ssl verify none sni str(record3.bug940.domain.tld) server s2 "${VTC_SOCK_TYPE}+${h1_ssl_addr}:${h1_ssl_port}" ssl verify none sni str(record3.bug940.domain.tld)
server s3 "${tmpdir}/first-ssl.sock" ssl verify none sni str(record2.bug940.domain.tld) server s3 "${VTC_SOCK_TYPE}+${h1_ssl_addr}:${h1_ssl_port}" ssl verify none sni str(record2.bug940.domain.tld)
listen first-ssl-fe listen first-ssl-fe
# note: strict-sni is enforced from ssl-default-bind-options above # note: strict-sni is enforced from ssl-default-bind-options above
mode http mode http
bind "${tmpdir}/first-ssl.sock" ssl crt-list ${testdir}/simple.crt-list bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl crt-list ${testdir}/simple.crt-list
server s1 ${s1_addr}:${s1_port} server s1 ${s1_addr}:${s1_port}
listen second-ssl-fe listen second-ssl-fe
mode http mode http
bind "${tmpdir}/second-ssl.sock" ssl no-strict-sni crt-list ${testdir}/localhost.crt-list bind "fd@${secondssl}" ssl no-strict-sni crt-list ${testdir}/localhost.crt-list
server s1 ${s1_addr}:${s1_port} server s1 ${s1_addr}:${s1_port}
} -start } -start