From b42420ab095b9c53d34853ac7b8a969bad96dccb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicki=20K=C5=99=C3=AD=C5=BEek?= <nicki@isc.org>
Date: Tue, 27 Aug 2024 14:21:09 +0200
Subject: [PATCH] Skip some tests on problematic OpenSSL version

The keyfromlabel and enginepkcs11 system tests are affected by a bug in
OpenSSL 3.0.13, currently shipped by debian bookworm.
---
 bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py | 3 +++
 bin/tests/system/isctest/mark.py                       | 7 +++++++
 bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py | 3 +++
 3 files changed, 13 insertions(+)

diff --git a/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py b/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py
index 334142dde2..71aa30fd40 100644
--- a/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py
+++ b/bin/tests/system/enginepkcs11/tests_sh_enginepkcs11.py
@@ -9,6 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+import isctest.mark
 
+
+@isctest.mark.supported_openssl_version
 def test_enginepkcs11(run_tests_sh):
     run_tests_sh()
diff --git a/bin/tests/system/isctest/mark.py b/bin/tests/system/isctest/mark.py
index 456586ac95..fd6f620276 100644
--- a/bin/tests/system/isctest/mark.py
+++ b/bin/tests/system/isctest/mark.py
@@ -13,6 +13,7 @@
 
 import os
 from pathlib import Path
+import ssl
 import subprocess
 
 import pytest
@@ -63,6 +64,12 @@ dnsrps_enabled = pytest.mark.skipif(
     not is_dnsrps_available(), reason="dnsrps disabled in the build"
 )
 
+supported_openssl_version = pytest.mark.skipif(
+    ssl.OPENSSL_VERSION_NUMBER >= 0x300000C0
+    and ssl.OPENSSL_VERSION_NUMBER < 0x300000E0,
+    reason="unsupported OpenSSL [GL #4814]",
+)
+
 
 try:
     import flaky as flaky_pkg  # type: ignore
diff --git a/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py b/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py
index 9cbf56e125..55a1252f0f 100644
--- a/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py
+++ b/bin/tests/system/keyfromlabel/tests_sh_keyfromlabel.py
@@ -9,6 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+import isctest.mark
 
+
+@isctest.mark.supported_openssl_version
 def test_keyfromlabel(run_tests_sh):
     run_tests_sh()