Repository navigation
mod_ssl: test the full SSLVHostSNIPolicy compatibility matrix - #1025
Merged
Merged
Conversation
New parametrized test of each SSLVHostSNIPolicy, and the default, against each class of vhost difference, gated on the server version. (TestVhostCompatAuthonly, TestVhostCompatAuthonlyAuth): Remove, covered by the above. * test/pyhttpd/env.py (HttpdTestEnv.has_directive): Remove; it only saw the directives of statically linked modules. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the two
authonlyclasses intest/modules/ssl/test_005_vhost_compat.pywith one parametrized class,TestVhostCompatPolicy, which checks the table in theSSLVHostSNIPolicydocumentation: each policy (and the default, with no directive) against vhosts differing in nothing, in server certificate, ciphers or protocol, and in client CA or verify depth, with and without SNI.A request for the handshake vhost itself is included for every policy. This is the regression test for 5f4b4bf (r1929631), the fix to
strictmode inssl_check_vhost_sni_policy(), which had no coverage: with that commit reverted the existing suite still passes, while thetest1-strictcases here fail as the child crashes.The old classes were gated on
env.has_directive(), which readshttpd -Land so only sees statically linked modules. With a shared mod_ssl theauthonlytests never set the directive and were reported as XFAIL/XPASS. The new class is gated withneed_min_apache_version("2.4.66")instead, andhas_directive()is removed as it has no other callers.A differing
SSLVerifyClientis not in the matrix: underinsecurethe request is allowed but then fails on post-handshake authentication, so there is no clean 200 to assert.SSLOpenSSLConfCmdis left out for portability.🤖 Generated with Claude Code