envoyproxy / envoyproxy/envoy

Tests depending on security level

Open
#38,488 5 comments 0 reactions 0 assignees View on GitHub
area/security area/tls no stalebot question
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: *Tests depending on security level*

*Description*:
We’re testing OpenSSL 3.2 in Envoy.
Some tests are failing.
Some of the failures seem related to the security level, which has been raised from 1 (in OpenSSL 3.0.x) to 2 (in OpenSSL 3.2.x).

TLS < 1.2 is not supported in security level 2.

Then in tls_inspector_test the following sub-tests:

- SniRegistered,
- AlpnRegistered,
- MultipleReads,
- NoExtensions,

will fail with input parameters **TLS1_VERSION** and **TLS1_1_VERSION**.

And the following will fail too, as they are using TLS1.0 and 1.1:

- ConnectionJA3HashTls10NoExtensions,
- ConnectionJA3HashTls11,

Then I’d ask if there are any plans for BoringSSL work in light of the security level 2.

[optional *Relevant Links*:]
See at the following link for more info on security levels:
https://www.ibm.com/docs/en/flashsystem-5x00/8.6.0?topic=r-security-levels-supported-security-ciphers

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.