diff --git a/.github/workflows/long-test.yml b/.github/workflows/long-test.yml index eb47525cd028..7a11b7967e6a 100644 --- a/.github/workflows/long-test.yml +++ b/.github/workflows/long-test.yml @@ -217,7 +217,7 @@ jobs: git config --global --add safe.directory /__w/CCF/CCF mkdir build cd build - cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Release .. + cmake -GNinja -DCOMPILE_TARGET=virtual -DCMAKE_BUILD_TYPE=Release -DCLIENT_PROTOCOLS_TEST=ON .. ninja - name: "Test" diff --git a/tests/client_protocols.py b/tests/client_protocols.py index 6bb6e3a46085..cc6f6a31751f 100644 --- a/tests/client_protocols.py +++ b/tests/client_protocols.py @@ -14,10 +14,20 @@ H2SPEC_BIN = "/opt/h2spec/h2spec" +def is_azure_linux(): + os_release = subprocess.check_output( + "cat /etc/os-release", universal_newlines=True, shell=True + ).lower() + return "ubuntu" not in os_release + + def compare_golden(): script_path = os.path.realpath(__file__) script_dir = os.path.dirname(script_path) - golden_file = os.path.join(script_dir, "tls_report.csv") + golden_file = os.path.join( + script_dir, + "tls_report_azure_linux.csv" if is_azure_linux() else "tls_report.csv", + ) print(f"Comparing output to golden file: {golden_file}") # Read both files into arrays diff --git a/tests/tls_report_azure_linux.csv b/tests/tls_report_azure_linux.csv new file mode 100644 index 000000000000..9c60f497746f --- /dev/null +++ b/tests/tls_report_azure_linux.csv @@ -0,0 +1,150 @@ +"ALPN","","INFO","http/1.1","","" +"BEAST","","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"BREACH","","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"CCS","","OK","not vulnerable","CVE-2014-0224","CWE-310" +"CRIME_TLS","","OK","not vulnerable","CVE-2012-4929","CWE-310" +"DNS_CAArecord","","LOW","--","","" +"DROWN","","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310" +"FREAK","","OK","not vulnerable","CVE-2015-0204","CWE-310" +"FS","","OK","offered","","" +"FS_ECDHE_curves","","OK","prime256v1 secp384r1 secp521r1","","" +"FS_TLS12_sig_algs","","INFO","ECDSA+SHA256 ECDSA+SHA384 ECDSA+SHA512 ECDSA-BRAINPOOL+SHA256 ECDSA-BRAINPOOL+SHA384 ECDSA-BRAINPOOL+SHA512 ECDSA+SHA224","","" +"FS_TLS13_sig_algs","","INFO","ECDSA+SHA384","","" +"FS_ciphers","","INFO","TLS_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"HPKP","","INFO","No support for HTTP Public Key Pinning","","" +"HSTS","","LOW","not offered","","" +"HTTP_clock_skew","","INFO","Got no HTTP time, maybe try different URL?","","" +"HTTP_status_code","","INFO","404 NOT_FOUND ('/')","","" +"LOGJAM","","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"LUCKY13","","OK","not vulnerable","CVE-2013-0169","CWE-310" +"NPN","","INFO","not offered","","" +"OCSP_stapling","","INFO","not offered","","" +"POODLE_SSL","","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"RC4","","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"ROBOT","","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"SSL_sessionID_support","","INFO","yes","","" +"SSLv2","","OK","not offered","","" +"SSLv3","","OK","not offered","","" +"SWEET32","","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" +"TLS1","","INFO","not offered","","" +"TLS1_1","","INFO","not offered","","" +"TLS1_2","","OK","offered","","" +"TLS1_3","","OK","offered with final","","" +"TLS_extensions","","INFO","'renegotiation info/#65281' 'EC point formats/#11' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'supported_groups/#10' 'max fragment length/#1' 'application layer protocol negotiation/#16' 'extended master secret/#23'","","" +"TLS_session_ticket","","INFO","valid for 7200 seconds only (