From 6671f17f65a2d4907f1b598dc2823209714f7ac2 Mon Sep 17 00:00:00 2001 From: Brad King Date: Thu, 29 Feb 2024 14:25:04 -0500 Subject: ctest: Add explicit options for TLS version Add a dedicated `TLSVersion` ctest option and a `CTEST_TLS_VERSION` variable to control it. Issue: #25701 --- Help/manual/cmake-variables.7.rst | 1 + Help/manual/ctest.1.rst | 9 +++++++++ Help/release/dev/curl-tls-version.rst | 5 +++-- Help/variable/CTEST_TLS_VERSION.rst | 13 +++++++++++++ Modules/DartConfiguration.tcl.in | 1 + Source/CTest/cmCTestCurl.cxx | 7 +++++++ Source/CTest/cmCTestCurl.h | 1 + Source/CTest/cmCTestSubmitCommand.cxx | 2 ++ Source/CTest/cmCTestSubmitHandler.cxx | 10 ++++++++++ .../FailDrop-TLSVersion-1.1-ctest-result.txt | 1 + .../FailDrop-TLSVersion-1.1-ctest-stderr.txt | 2 ++ .../FailDrop-TLSVersion-1.1-ctest-stdout.txt | 1 + .../RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1.cmake | 1 + Tests/RunCMake/CTestCommandLine/RunCMakeTest.cmake | 1 + .../ctest_submit/FailDrop-TLSVersion-1.1-result.txt | 1 + .../ctest_submit/FailDrop-TLSVersion-1.1-stderr.txt | 2 ++ .../ctest_submit/FailDrop-TLSVersion-1.1-stdout.txt | 4 ++++ Tests/RunCMake/ctest_submit/RunCMakeTest.cmake | 2 ++ 18 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 Help/variable/CTEST_TLS_VERSION.rst create mode 100644 Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-result.txt create mode 100644 Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stderr.txt create mode 100644 Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stdout.txt create mode 100644 Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1.cmake create mode 100644 Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-result.txt create mode 100644 Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stderr.txt create mode 100644 Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stdout.txt diff --git a/Help/manual/cmake-variables.7.rst b/Help/manual/cmake-variables.7.rst index 7728cb4..4bb0ec8 100644 --- a/Help/manual/cmake-variables.7.rst +++ b/Help/manual/cmake-variables.7.rst @@ -729,6 +729,7 @@ Variables for CTest /variable/CTEST_TEST_LOAD /variable/CTEST_TEST_TIMEOUT /variable/CTEST_TLS_VERIFY + /variable/CTEST_TLS_VERSION /variable/CTEST_UPDATE_COMMAND /variable/CTEST_UPDATE_OPTIONS /variable/CTEST_UPDATE_VERSION_ONLY diff --git a/Help/manual/ctest.1.rst b/Help/manual/ctest.1.rst index 45ff6da..c9ab31e 100644 --- a/Help/manual/ctest.1.rst +++ b/Help/manual/ctest.1.rst @@ -1551,6 +1551,15 @@ Configuration settings include: * `CTest Script`_ variable: :variable:`CTEST_SUBMIT_INACTIVITY_TIMEOUT` * :module:`CTest` module variable: ``CTEST_SUBMIT_INACTIVITY_TIMEOUT`` +``TLSVersion`` + .. versionadded:: 3.30 + + Specify a minimum TLS version allowed when submitting to a dashboard + via ``https://`` URLs. + + * `CTest Script`_ variable: :variable:`CTEST_TLS_VERSION` + * :module:`CTest` module variable: ``CTEST_TLS_VERSION`` + ``TLSVerify`` .. versionadded:: 3.30 diff --git a/Help/release/dev/curl-tls-version.rst b/Help/release/dev/curl-tls-version.rst index 6adf189..636fa3c 100644 --- a/Help/release/dev/curl-tls-version.rst +++ b/Help/release/dev/curl-tls-version.rst @@ -17,5 +17,6 @@ curl-tls-version to ``https://`` URLs. * The :command:`ctest_submit` command and :option:`ctest -T Submit ` - step gained a ``TLSVerify`` option to control negotiation with - ``https://`` URLs. See the :variable:`CTEST_TLS_VERIFY` variable. + step gained ``TLSVersion`` and ``TLSVerify`` options to control negotiation + with ``https://`` URLs. See the :variable:`CTEST_TLS_VERSION` and + :variable:`CTEST_TLS_VERIFY` variables. diff --git a/Help/variable/CTEST_TLS_VERSION.rst b/Help/variable/CTEST_TLS_VERSION.rst new file mode 100644 index 0000000..c19d2a4 --- /dev/null +++ b/Help/variable/CTEST_TLS_VERSION.rst @@ -0,0 +1,13 @@ +CTEST_TLS_VERSION +----------------- + +.. versionadded:: 3.30 + +Specify the CTest ``TLSVersion`` setting in a :manual:`ctest(1)` +:ref:`Dashboard Client` script or in project ``CMakeLists.txt`` code +before including the :module:`CTest` module. The value is a minimum +TLS version allowed when submitting to a dashboard via ``https://`` URLs. + +The value may be one of: + +.. include:: CMAKE_TLS_VERSION-VALUES.txt diff --git a/Modules/DartConfiguration.tcl.in b/Modules/DartConfiguration.tcl.in index eb0f0ba..67d9f8f 100644 --- a/Modules/DartConfiguration.tcl.in +++ b/Modules/DartConfiguration.tcl.in @@ -96,6 +96,7 @@ TimeOut: @DART_TESTING_TIMEOUT@ TestLoad: @CTEST_TEST_LOAD@ TLSVerify: @CTEST_TLS_VERIFY@ +TLSVersion: @CTEST_TLS_VERSION@ UseLaunchers: @CTEST_USE_LAUNCHERS@ CurlOptions: @CTEST_CURL_OPTIONS@ diff --git a/Source/CTest/cmCTestCurl.cxx b/Source/CTest/cmCTestCurl.cxx index e5963c6..3a5806b 100644 --- a/Source/CTest/cmCTestCurl.cxx +++ b/Source/CTest/cmCTestCurl.cxx @@ -58,6 +58,9 @@ size_t curlDebugCallback(CURL* /*unused*/, curl_infotype /*unused*/, cmCTestCurlOpts::cmCTestCurlOpts(cmCTest* ctest) { + this->TLSVersionOpt = + cmCurlParseTLSVersion(ctest->GetCTestConfiguration("TLSVersion")); + std::string tlsVerify = ctest->GetCTestConfiguration("TLSVerify"); if (!tlsVerify.empty()) { this->TLSVerifyOpt = cmIsOn(tlsVerify); @@ -80,6 +83,10 @@ bool cmCTestCurl::InitCurl() return false; } cmCurlSetCAInfo(this->Curl); + if (this->CurlOpts.TLSVersionOpt) { + curl_easy_setopt(this->Curl, CURLOPT_SSLVERSION, + *this->CurlOpts.TLSVersionOpt); + } if (this->CurlOpts.TLSVerifyOpt) { curl_easy_setopt(this->Curl, CURLOPT_SSL_VERIFYPEER, *this->CurlOpts.TLSVerifyOpt ? 1 : 0); diff --git a/Source/CTest/cmCTestCurl.h b/Source/CTest/cmCTestCurl.h index b027e43..7836f4b 100644 --- a/Source/CTest/cmCTestCurl.h +++ b/Source/CTest/cmCTestCurl.h @@ -16,6 +16,7 @@ class cmCTest; struct cmCTestCurlOpts { cmCTestCurlOpts(cmCTest* ctest); + cm::optional TLSVersionOpt; cm::optional TLSVerifyOpt; bool VerifyHostOff = false; }; diff --git a/Source/CTest/cmCTestSubmitCommand.cxx b/Source/CTest/cmCTestSubmitCommand.cxx index 90542e9..616ad4a 100644 --- a/Source/CTest/cmCTestSubmitCommand.cxx +++ b/Source/CTest/cmCTestSubmitCommand.cxx @@ -56,6 +56,8 @@ cmCTestGenericHandler* cmCTestSubmitCommand::InitializeHandler() } this->CTest->SetCTestConfigurationFromCMakeVariable( + this->Makefile, "TLSVersion", "CTEST_TLS_VERSION", this->Quiet); + this->CTest->SetCTestConfigurationFromCMakeVariable( this->Makefile, "TLSVerify", "CTEST_TLS_VERIFY", this->Quiet); this->CTest->SetCTestConfigurationFromCMakeVariable( this->Makefile, "CurlOptions", "CTEST_CURL_OPTIONS", this->Quiet); diff --git a/Source/CTest/cmCTestSubmitHandler.cxx b/Source/CTest/cmCTestSubmitHandler.cxx index 431f108..74cbeef 100644 --- a/Source/CTest/cmCTestSubmitHandler.cxx +++ b/Source/CTest/cmCTestSubmitHandler.cxx @@ -178,6 +178,16 @@ bool cmCTestSubmitHandler::SubmitUsingHTTP( curl = curl_easy_init(); if (curl) { cmCurlSetCAInfo(curl); + if (curlOpts.TLSVersionOpt) { + cm::optional tlsVersionStr = + cmCurlPrintTLSVersion(*curlOpts.TLSVersionOpt); + cmCTestOptionalLog( + this->CTest, HANDLER_VERBOSE_OUTPUT, + " Set CURLOPT_SSLVERSION to " + << (tlsVersionStr ? *tlsVersionStr : "unknown value") << "\n", + this->Quiet); + curl_easy_setopt(curl, CURLOPT_SSLVERSION, *curlOpts.TLSVersionOpt); + } if (curlOpts.TLSVerifyOpt) { cmCTestOptionalLog(this->CTest, HANDLER_VERBOSE_OUTPUT, " Set CURLOPT_SSL_VERIFYPEER to " diff --git a/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-result.txt b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-result.txt new file mode 100644 index 0000000..d197c91 --- /dev/null +++ b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-result.txt @@ -0,0 +1 @@ +[^0] diff --git a/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stderr.txt b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stderr.txt new file mode 100644 index 0000000..e3df62f --- /dev/null +++ b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stderr.txt @@ -0,0 +1,2 @@ +Error message was: ([Cc]ould *n.t resolve host:? '?badhostname.invalid'?|The requested URL returned error:|Protocol "https" (not supported or disabled|not supported|disabled)|.* was built with SSL disabled).* + Problems when submitting via HTTP diff --git a/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stdout.txt b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stdout.txt new file mode 100644 index 0000000..e83d934 --- /dev/null +++ b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1-ctest-stdout.txt @@ -0,0 +1 @@ + Set CURLOPT_SSLVERSION to CURL_SSLVERSION_TLSv1_1 diff --git a/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1.cmake b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1.cmake new file mode 100644 index 0000000..e0368fc --- /dev/null +++ b/Tests/RunCMake/CTestCommandLine/FailDrop-TLSVersion-1.1.cmake @@ -0,0 +1 @@ +include(FailDrop-common.cmake) diff --git a/Tests/RunCMake/CTestCommandLine/RunCMakeTest.cmake b/Tests/RunCMake/CTestCommandLine/RunCMakeTest.cmake index c7f772c..27a6fab 100644 --- a/Tests/RunCMake/CTestCommandLine/RunCMakeTest.cmake +++ b/Tests/RunCMake/CTestCommandLine/RunCMakeTest.cmake @@ -496,6 +496,7 @@ function(run_FailDrop case) ${CMAKE_CTEST_COMMAND} -M Experimental -T Submit -VV ) endfunction() +run_FailDrop(TLSVersion-1.1 -DCTEST_TLS_VERSION=1.1) run_FailDrop(TLSVerify-ON -DCTEST_TLS_VERIFY=ON) run_FailDrop(TLSVerify-OFF -DCTEST_TLS_VERIFY=OFF) diff --git a/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-result.txt b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-result.txt new file mode 100644 index 0000000..b57e2de --- /dev/null +++ b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-result.txt @@ -0,0 +1 @@ +(-1|255) diff --git a/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stderr.txt b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stderr.txt new file mode 100644 index 0000000..e3df62f --- /dev/null +++ b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stderr.txt @@ -0,0 +1,2 @@ +Error message was: ([Cc]ould *n.t resolve host:? '?badhostname.invalid'?|The requested URL returned error:|Protocol "https" (not supported or disabled|not supported|disabled)|.* was built with SSL disabled).* + Problems when submitting via HTTP diff --git a/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stdout.txt b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stdout.txt new file mode 100644 index 0000000..be83798 --- /dev/null +++ b/Tests/RunCMake/ctest_submit/FailDrop-TLSVersion-1.1-stdout.txt @@ -0,0 +1,4 @@ +SetCTestConfigurationFromCMakeVariable:TLSVersion:CTEST_TLS_VERSION +SetCTestConfiguration:TLSVersion:1\.1 +.* + Set CURLOPT_SSLVERSION to CURL_SSLVERSION_TLSv1_1 diff --git a/Tests/RunCMake/ctest_submit/RunCMakeTest.cmake b/Tests/RunCMake/ctest_submit/RunCMakeTest.cmake index 4d2d95b..5ac568f 100644 --- a/Tests/RunCMake/ctest_submit/RunCMakeTest.cmake +++ b/Tests/RunCMake/ctest_submit/RunCMakeTest.cmake @@ -57,6 +57,8 @@ run_ctest_submit_FailDrop(http) run_ctest_submit_FailDrop(https) block() set(CASE_DROP_METHOD "https") + set(CASE_TEST_PREFIX_CODE "set(CTEST_TLS_VERSION 1.1)") + run_ctest(FailDrop-TLSVersion-1.1 -VV) set(CASE_TEST_PREFIX_CODE "set(CTEST_TLS_VERIFY ON)") run_ctest(FailDrop-TLSVerify-ON -VV) set(CASE_TEST_PREFIX_CODE "set(CTEST_TLS_VERIFY OFF)") -- cgit v0.12