]> www.infradead.org Git - users/dwmw2/openconnect.git/commit
Mark obsolete-server-crypto test as XFAIL in Fedora/GnuTLS/* CI
authorDaniel Lenski <dlenski@gmail.com>
Sat, 29 May 2021 17:39:57 +0000 (10:39 -0700)
committerDavid Woodhouse <dwmw2@infradead.org>
Sat, 12 Jun 2021 08:52:21 +0000 (09:52 +0100)
commitf39ad183b1dd0508a8fae68f809922228ae33ec1
treeec59c29f9f3848ec2c4c96c383c451c2f3f75f26
parent7e862f2f0352409357fa7a4762481fde49909eb8
Mark obsolete-server-crypto test as XFAIL in Fedora/GnuTLS/* CI

The system-wide minimum crypto policy on Fedora prevents us from enabling
3DES and RC4 ciphers via GnuTLS priority strings. We have unconditionally
disabled it in OpenConnect for now in commit 7e862f2f03 but the
obsolete-server-crypto test is *still* failing, with ocserv reporting
'GnuTLS error (at worker-vpn.c:861): No supported cipher suites have
been found.'

Just mark obsolete-server-crypto test as XFAIL for these builds.  It's
the most accurate description of the state of those tests: these
environments do not provide OpenConnect with the capabilities to
reliably enable obsolete/insecure crypto algorithms in a self-contained
way.

See https://bugzilla.redhat.com/show_bug.cgi?id=1960763 for ongoing
discussions about how to come up with a more reliable, testable, and
maintainable mechanism for OpenConnect to enable these algorithms without
compromising the system-wide minimum crypto policy.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
.gitlab-ci.yml