You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.4 KiB
64 lines
2.4 KiB
10 months ago
|
From a00a70b7195438c543191b69382ff20e452548bf Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
||
|
|
Date: Mon, 13 Aug 2018 12:33:58 +0200
|
||
|
|
Subject: [PATCH] Adapt CTX_get_min_proto_version tests to system-wide policy
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
In our distribution, /etc/crypto-policies/back-ends/opensslcnf.config
|
||
|
|
can override default minimal SSL/TLS protocol version. If it does,
|
||
|
|
t/local/09_ctx_new.t test will fail because OpenSSL will return
|
||
|
|
different then 0 value.
|
||
|
|
|
||
|
|
This patch parses the configuration file and adjusts expect values in
|
||
|
|
the test.
|
||
|
|
|
||
|
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||
|
|
---
|
||
|
|
t/local/09_ctx_new.t | 22 ++++++++++++++++++++--
|
||
|
|
1 file changed, 20 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/t/local/09_ctx_new.t b/t/local/09_ctx_new.t
|
||
|
|
index 6d06f21..c584856 100644
|
||
|
|
--- a/t/local/09_ctx_new.t
|
||
|
|
+++ b/t/local/09_ctx_new.t
|
||
|
|
@@ -109,14 +109,32 @@ else
|
||
|
|
# Having TLS_method() does not necessarily that proto getters are available
|
||
|
|
if ($ctx_tls && exists &Net::SSLeay::CTX_get_min_proto_version)
|
||
|
|
{
|
||
|
|
+ my $min_ver = 0;
|
||
|
|
+ # Adjust minimal version to system-wide crypto policy
|
||
|
|
+ if (open(my $f, '<', '/etc/crypto-policies/back-ends/opensslcnf.config')) {
|
||
|
|
+ while(<$f>) {
|
||
|
|
+ if (/^MinProtocol = ([\w.]+)\b/) {
|
||
|
|
+ if ($1 eq 'TLSv1') {
|
||
|
|
+ $min_ver = 0x0301;
|
||
|
|
+ } elsif ($1 eq 'TLSv1.1') {
|
||
|
|
+ $min_ver = 0x0302;
|
||
|
|
+ } elsif ($1 eq 'TLSv1.2') {
|
||
|
|
+ $min_ver = 0x0303;
|
||
|
|
+ } elsif ($1 eq 'TLSv1.3') {
|
||
|
|
+ $min_ver = 0x0304;
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
+ close($f);
|
||
|
|
+ }
|
||
|
|
my $ver;
|
||
|
|
$ver = Net::SSLeay::CTX_get_min_proto_version($ctx_tls);
|
||
|
|
- is($ver, 0, 'TLS_method CTX has automatic minimum version');
|
||
|
|
+ is($ver, $min_ver, 'TLS_method CTX has automatic minimum version');
|
||
|
|
$ver = Net::SSLeay::CTX_get_max_proto_version($ctx_tls);
|
||
|
|
is($ver, 0, 'TLS_method CTX has automatic maximum version');
|
||
|
|
|
||
|
|
$ver = Net::SSLeay::get_min_proto_version($ssl_tls);
|
||
|
|
- is($ver, 0, 'SSL from TLS_method CTX has automatic minimum version');
|
||
|
|
+ is($ver, $min_ver, 'SSL from TLS_method CTX has automatic minimum version');
|
||
|
|
$ver = Net::SSLeay::get_max_proto_version($ssl_tls);
|
||
|
|
is($ver, 0, 'SSL from TLS_method CTX has automatic maximum version');
|
||
|
|
|
||
|
|
--
|
||
|
|
2.14.4
|
||
|
|
|