From 6eece5b666a36094f5ebef93b9683df06b81c698 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sat, 10 Aug 2019 17:38:34 +0200 Subject: [PATCH] Exclude DTLS 1.2 only with older OpenSSL compat.sh used to skip OpenSSL altogether for DTLS 1.2, because older versions of OpenSSL didn't support it. But these days it is supported. We don't want to use DTLS 1.2 with OpenSSL unconditionally, because we still use legacy versions of OpenSSL to test with legacy ciphers. So check whether the version we're using supports it. --- tests/compat.sh | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index 80c2d31a3..54bc0b7d1 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -216,14 +216,13 @@ filter_ciphersuites() G_CIPHERS=$( filter "$G_CIPHERS" ) fi - # OpenSSL 1.0.1h doesn't support DTLS 1.2 - if [ `minor_ver "$MODE"` -ge 3 ] && is_dtls "$MODE"; then + # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL + # supports from the s_server help. (The s_client help isn't + # accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it. + # But the s_server help seems to be accurate.) + if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then + M_CIPHERS="" O_CIPHERS="" - case "$PEER" in - [Oo]pen*) - M_CIPHERS="" - ;; - esac fi # For GnuTLS client -> mbed TLS server,