From ca74355fb141cc88021b4c2b2ffb2bf3532070f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Gajdu=C5=A1ek?= Date: Tue, 14 Jul 2026 12:56:00 +0200 Subject: [PATCH] Refs #39518 - Pin tls_ciphers to OpenSSL defaults in HTTPS integration tests SSLClientVerificationIntegrationTest launches a real WEBrick HTTPS server without setting tls_ciphers, so it falls through to launcher.rb's crypto-policies auto-detection and inherits whatever the host's OpenSSL build happens to support. On a host where /etc/crypto-policies files are present but the linked OpenSSL doesn't understand the 'PROFILE=SYSTEM' cipher-list alias (e.g. a vendored, non-RHEL-patched OpenSSL), the test fails with a RuntimeError before ever reaching the actual SSL client verification behavior it's meant to check. Pin tls_ciphers to '' (OpenSSL defaults, no restriction) by default for HTTPS integration tests in test_helper.rb, so this test suite doesn't depend on the host's crypto-policies/OpenSSL combination. Auto-detection itself is already covered deterministically by the mocked unit tests in test/launcher_test.rb; this integration test only needs a working TLS handshake, not any particular cipher policy. This is a CI-only workaround; see #39518 for the underlying resolve_tls_ciphers robustness fix. --- test/test_helper.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/test/test_helper.rb b/test/test_helper.rb index 17d3c8a5d..8701a43f4 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -40,7 +40,11 @@ def setup def launch(protocol: 'https', plugins: [], settings: {}) port = 0 - @settings = Proxy::Settings::Global.new(settings.merge("#{protocol}_port" => port)) + # Pin tls_ciphers to OpenSSL defaults unless a test overrides it, so HTTPS + # integration tests don't depend on the host's crypto-policies/OpenSSL + # combination (tests shouldn't rely on where they happen to run). + default_settings = (protocol == 'https') ? { tls_ciphers: '' } : {} + @settings = Proxy::Settings::Global.new(default_settings.merge(settings).merge("#{protocol}_port" => port)) @t = Thread.new do launcher = Proxy::Launcher.new(@settings) app = launcher.public_send("#{protocol}_app", port, plugins)