Exclude FIPS+TLSv1.2 testing with native client (ojdk lacks ems support) #35
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
judovana
reviewed
Aug 4, 2025
| if [ 1 = "$(TEST_PKCS11_FIPS)" ] ; then \ | ||
| if ! [ 1 = "$(JAVA_CONF_FIPS)" ] || ! [ 1 = "$(FIPS_MODE_ENABLED)" ] ; then \ | ||
| printf '%s' 'TLSv1|TLSv1.1|TLSv1.3' ; \ | ||
| elif [ 1 = "$(SSLTESTS_USE_OPENSSL_CLIENT)" ] || [ 1 = "$(SSLTESTS_USE_GNUTLS_CLIENT)" ] || [ 1 = "$(SSLTESTS_USE_NSS_CLIENT)" ] ; then \ |
Collaborator
There was a problem hiding this comment.
Maybe it can include jdk version in this condition? And for jdk26 and up it can conisder pkcs11 as standartised?
Collaborator
Author
There was a problem hiding this comment.
I am not aware this would be implemented in any jdk version (or expected to be implemented) . Only jdk21+ (?) also supports TLSv1.3 in FIPS, which does not have this problem.
Collaborator
Author
There was a problem hiding this comment.
Maybe it will be implemented in future version, but I would wait for it to happen...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently cases using TLSv1.2 fail in fips mode, when native client is used. It is because openjdk lacks EMS (extended master secret) support for TLSv1.2. This seems unlikely to be fixed soon (waits for pkcs11 mechanism to be standartized).
So exclude TLSV1.2+FIPS+native clients. (Can be re-enabled if implemented)