haproxy/reg-tests/ssl/ssl_default_server.vtc

#REGTEST_TYPE=devel

# This reg-test ensures that SSL related configuration specified in a
# default-server option are properly taken into account by the servers
# (frontend). It mainly focuses on the client certificate used by the frontend,
# that can either be defined in the server line itself, in the default-server
# line or in both.
#
# It was created following a bug raised in redmine (issue #3906) in which a
# server used an "empty" SSL context instead of the proper one.
#

varnishtest "Test the 'set ssl cert' feature of the CLI"
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"

setenv VTC_SOCK_TYPE stream
include ${testdir}/ssl_default_server.vtci
BUG/MINOR: ssl: Default-server configuration ignored by server When a default-server line specified a client certificate to use, the frontend would not take it into account and create an empty SSL context, which would raise an error on the backend side ("peer did not return a certificate"). This bug was introduced by d817dc733eacfd7cf5bb0bbc6128f44644db078e in which the SSL contexts are created earlier than before (during the default-server line parsing) without setting it in the corresponding server structures. It then made the server create an empty SSL context in ssl_sock_prepare_srv_ctx because it thought it needed one. It was raised on redmine, in Bug #3906. It can be backported to 2.4. 2021-07-13 12:28:22 -04:00			`#REGTEST_TYPE=devel`

			`# This reg-test ensures that SSL related configuration specified in a`
			`# default-server option are properly taken into account by the servers`
			`# (frontend). It mainly focuses on the client certificate used by the frontend,`
			`# that can either be defined in the server line itself, in the default-server`
			`# line or in both.`
			`#`
			`# It was created following a bug raised in redmine (issue #3906) in which a`
			`# server used an "empty" SSL context instead of the proper one.`
			`#`

			`varnishtest "Test the 'set ssl cert' feature of the CLI"`
			`feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"`
			`feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"`

REGTESTS: quic: ssl_default_server.vtc supported by QUIC ssl/ssl_default_server.vtc was renamed to ssl/ssl_default_server.vtci to produce a common part runnable both for QUIC and TCP listeners. Then ssl_default_server.vtc files were created both under ssl and quic directories to call this .vtci file with correct VTC_SOCK_TYPE environment values ("quic" for QUIC listeners and "stream" for TCP listeners); 2025-12-01 13:12:03 -05:00			`setenv VTC_SOCK_TYPE stream`
			`include ${testdir}/ssl_default_server.vtci`