From 7d0e658386b3e673f492fb1c3f07d268e6bd28c9 Mon Sep 17 00:00:00 2001 From: Zhangsen Wang Date: Wed, 29 Jun 2022 07:33:35 +0000 Subject: [PATCH 1/2] Re-enable 7 tests disabled in mbedtls-2.28 because of an old OpenSSL bug Signed-off-by: Zhangsen Wang --- tests/ssl-opt.sh | 36 +++++++++++++++--------------------- 1 file changed, 15 insertions(+), 21 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index fb9746f252..e3147470c3 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9203,12 +9203,9 @@ run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.0" \ 0 \ -s "fragmenting handshake message" -## Interop test with OpenSSL might trigger a bug in recent versions (including -## all versions installed on the CI machines), reported here: -## Bug report: https://github.com/openssl/openssl/issues/6902 -## They should be re-enabled once a fixed version of OpenSSL is available -## (this should happen in some 1.1.1_ release according to the ticket). -skip_next_test +## The four tests below require 1.1.1a or higher version of openssl, otherwise +## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) +requires_openssl_next requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -9216,7 +9213,7 @@ client_needs_more_time 4 requires_max_content_len 2048 run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \ -p "$P_PXY drop=8 delay=8 duplicate=8" \ - "$O_SRV -dtls1_2 -verify 10" \ + "$O_NEXT_SRV -dtls1_2 -verify 10" \ "$P_CLI dtls=1 debug_level=2 \ crt_file=data_files/server8_int-ca2.crt \ key_file=data_files/server8.key \ @@ -9225,7 +9222,7 @@ run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \ -c "fragmenting handshake message" \ -C "error" -skip_next_test +requires_openssl_next requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -9233,7 +9230,7 @@ client_needs_more_time 4 requires_max_content_len 2048 run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.0" \ -p "$P_PXY drop=8 delay=8 duplicate=8" \ - "$O_SRV -dtls1 -verify 10" \ + "$O_NEXT_SRV -dtls1 -verify 10" \ "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ crt_file=data_files/server8_int-ca2.crt \ key_file=data_files/server8.key \ @@ -9242,7 +9239,7 @@ run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.0" \ -c "fragmenting handshake message" \ -C "error" -skip_next_test +requires_openssl_next requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -9260,7 +9257,7 @@ run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \ # -nbio is added to prevent s_client from blocking in case of duplicated # messages at the end of the handshake -skip_next_test +requires_openssl_next requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -10267,32 +10264,29 @@ run_test "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \ -s "Extra-header:" \ -c "HTTP/1.0 200 OK" -## Interop tests with OpenSSL might trigger a bug in recent versions (including -## all versions installed on the CI machines), reported here: -## Bug report: https://github.com/openssl/openssl/issues/6902 -## They should be re-enabled once a fixed version of OpenSSL is available -## (this should happen in some 1.1.1_ release according to the ticket). -skip_next_test +## The three tests below require 1.1.1a or higher version of openssl, otherwise +## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) +requires_openssl_next client_needs_more_time 6 not_with_valgrind # risk of non-mbedtls peer timing out run_test "DTLS proxy: 3d, openssl server" \ -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ - "$O_SRV -dtls1 -mtu 2048" \ + "$O_NEXT_SRV -dtls1 -mtu 2048" \ "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ 0 \ -c "HTTP/1.0 200 OK" -skip_next_test # see above +requires_openssl_next client_needs_more_time 8 not_with_valgrind # risk of non-mbedtls peer timing out run_test "DTLS proxy: 3d, openssl server, fragmentation" \ -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ - "$O_SRV -dtls1 -mtu 768" \ + "$O_NEXT_SRV -dtls1 -mtu 768" \ "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ 0 \ -c "HTTP/1.0 200 OK" -skip_next_test # see above +requires_openssl_next client_needs_more_time 8 not_with_valgrind # risk of non-mbedtls peer timing out run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \ From 1c981f5c8451edf8355ba7b89953515fc42e10ce Mon Sep 17 00:00:00 2001 From: Zhangsen Wang Date: Tue, 2 Aug 2022 06:18:40 +0000 Subject: [PATCH 2/2] skip test with openssl client because it will timeout with certain seed due to an openssl bug Signed-off-by: Zhangsen Wang --- tests/ssl-opt.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index e3147470c3..56753761ca 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -9203,7 +9203,7 @@ run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.0" \ 0 \ -s "fragmenting handshake message" -## The four tests below require 1.1.1a or higher version of openssl, otherwise +## The two tests below require 1.1.1a or higher version of openssl, otherwise ## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) requires_openssl_next requires_config_enabled MBEDTLS_SSL_PROTO_DTLS @@ -9239,7 +9239,9 @@ run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.0" \ -c "fragmenting handshake message" \ -C "error" -requires_openssl_next +## the two tests below will time out with certain seed. +## The cause is an openssl bug (https://github.com/openssl/openssl/issues/18887) +skip_next_test requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -9257,7 +9259,7 @@ run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \ # -nbio is added to prevent s_client from blocking in case of duplicated # messages at the end of the handshake -requires_openssl_next +skip_next_test requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -10291,7 +10293,7 @@ client_needs_more_time 8 not_with_valgrind # risk of non-mbedtls peer timing out run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \ -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ - "$O_SRV -dtls1 -mtu 768" \ + "$O_NEXT_SRV -dtls1 -mtu 768" \ "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2 tickets=0" \ 0 \ -c "HTTP/1.0 200 OK"