9cbd536c42
Add a test to test Ruby OpenSSL to respect cypto-policies TLS minimal version, and test the issue identified at the ticket RHEL-21019. https://issues.redhat.com/browse/RHEL-21019 If Ruby OpenSSL doesn't include the following upstream patch, the test fails as follows. https://github.com/ruby/openssl/pull/710 ``` $ tmt -c distro=fedora-rawhide run --all provision -h virtual -i fedora-rawhide tests -n '^/tls-minimal-version$' /var/tmp/tmt/run-007 ... total: 1 test failed $ tmt run --id run-007 report -vvv ... :: [ 16:03:29 ] :: [ BEGIN ] :: Running Ruby OpenSSL client :: actually running 'ruby /var/tmp/tmt/run-007/plans/all/discover/default-0/tests/tls-minimal-version/test.rb -v' STDOUT: Loaded suite /var/tmp/tmt/run-007/plans/all/discover/default-0/tests/tls-minimal-version/test STDOUT: Started STDOUT: TestRubyOpenSSLTLSMin: STDOUT: test_connection_to_tls_1_2_server_to_fail: F STDOUT: =============================================================================== STDOUT: Failure: test_connection_to_tls_1_2_server_to_fail(TestRubyOpenSSLTLSMin): <OpenSSL::SSL::SSLError> exception was expected but none was thrown. STDOUT: /var/tmp/tmt/run-007/plans/all/discover/default-0/tests/tls-minimal-version/test.rb:13:in `test_connection_to_tls_1_2_server_to_fail' STDOUT: 10: STDOUT: 11: class TestRubyOpenSSLTLSMin < Test::Unit::TestCase STDOUT: 12: def test_connection_to_tls_1_2_server_to_fail STDOUT: => 13: assert_raise_with_message(OpenSSL::SSL::SSLError, STDOUT: 14: /tlsv1 alert protocol version/) do STDOUT: 15: connect(CONFIG_ITEMS[:tls_1_2][:host], CONFIG_ITEMS[:tls_1_2][:port]) STDOUT: 16: end STDOUT: =============================================================================== STDOUT: : (0.075125) STDOUT: test_onnection_to_tls_1_3_server_to_pass: .: (0.013862) STDOUT: STDOUT: Finished in 0.089378126 seconds. STDOUT: ------------------------------------------------------------------------------- STDOUT: 2 tests, 2 assertions, 1 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications STDOUT: 50% passed STDOUT: ------------------------------------------------------------------------------- STDOUT: 22.38 tests/s, 22.38 assertions/s :: [ 16:03:30 ] :: [ FAIL ] :: Running Ruby OpenSSL client (Expected 0, got 1) ... total: 1 test failed ```
33 lines
914 B
Ruby
33 lines
914 B
Ruby
require 'net/http'
|
|
require 'test/unit'
|
|
|
|
DOMAIN = 'localhost'
|
|
CONFIG_ITEMS = {
|
|
tls_1_2: { host: "tls-12.#{DOMAIN}", port: 44_312 },
|
|
tls_1_3: { host: "tls-13.#{DOMAIN}", port: 44_313 }
|
|
}.freeze
|
|
CA_FILE = 'test.crt'
|
|
|
|
class TestRubyOpenSSLTLSMin < Test::Unit::TestCase
|
|
def test_connection_to_tls_1_2_server_to_fail
|
|
assert_raise_with_message(OpenSSL::SSL::SSLError,
|
|
/tlsv1 alert protocol version/) do
|
|
connect(CONFIG_ITEMS[:tls_1_2][:host], CONFIG_ITEMS[:tls_1_2][:port])
|
|
end
|
|
end
|
|
|
|
def test_onnection_to_tls_1_3_server_to_pass
|
|
assert(connect(CONFIG_ITEMS[:tls_1_3][:host],
|
|
CONFIG_ITEMS[:tls_1_3][:port]))
|
|
end
|
|
|
|
def connect(host, port)
|
|
uri = URI("https://#{host}")
|
|
Net::HTTP.start(host,
|
|
port,
|
|
use_ssl: true,
|
|
ca_file: CA_FILE) do |http|
|
|
http.get(uri)
|
|
end
|
|
end
|
|
end
|