Do not set @SECLEVEL with boringssl

[masaori335]

An AuTest filed with boringssl. It looks like boringssl doesn't like the change for the openssl 3.0 (#9753).

file /tmp/_sandbox/tls_client_versions/ts/log/diags.log : Diags log file diags.log should not contain errors - Failed
             Reason: Contents of /tmp/_sandbox/tls_client_versions/ts/log/diags.log contains expression: "ERROR:"
                Details:
                  [Jul  6 02:15:55.834] traffic_server ERROR: SSL::140521672264768:error:1000009e:SSL routines:OPENSSL_internal:INVALID_COMMAND:/opt/boringssl/ssl/ssl_cipher.cc:1108 : 21
                  [Jul  6 02:15:55.834] traffic_server ERROR: invalid cipher suite in records.config : 22
                  [Jul  6 02:15:55.834] traffic_server ERROR: SSL::140521672264768:error:1000009e:SSL routines:OPENSSL_internal:INVALID_COMMAND:/opt/boringssl/ssl/ssl_cipher.cc:1108 : 23
                  [Jul  6 02:15:55.834] traffic_server ERROR: invalid cipher suite in records.config : 24
                  [Jul  6 02:15:55.865] [ET_NET 8] ERROR: SSL::140521545656064:error:100000b9:SSL routines:OPENSSL_internal:NULL_SSL_CTX:/opt/boringssl/ssl/ssl_lib.cc:633: peer address is 127.0.0.1 : 45
                  [Jul  6 02:15:55.865] [ET_NET 8] ERROR: failed to create SSL server session : 46
                  [Jul  6 02:15:55.978] [ET_NET 9] ERROR: SSL::140521544603392:error:100000b9:SSL routines:OPENSSL_internal:NULL_SSL_CTX:/opt/boringssl/ssl/ssl_lib.cc:633: peer address is 127.0.0.1 : 47
                  [Jul  6 02:15:55.978] [ET_NET 9] ERROR: failed to create SSL server session : 48

[maskit]

Too much duplication. I'd suggest:

cipher_suite = "The basic ones"
if openssl_version == 3
  cipher_suite += ":@SECLEVEL=0"
endif

and

'proxy.config.ssl.server.cipher_suite': '{0}'.format(cipher_suite),

[bneradt]

SECLEVEL=0 was OK for a stopgap, but I assume there's a better way to address this. Should the cipher suite value be updated for the more stringent openssl3? This would presumably make boringssl happy too.

[bneradt]

I assume tests/gold_tests/tls/tls_client_versions_minmax.test.py will need to be updated with a similar change?

[bneradt]

SECLEVEL=0 was OK for a stopgap, but I assume there's a better way to address this. Should the cipher suite value be updated for the more stringent openssl3? This would presumably make boringssl happy too.

Ah, nevermind. I suppose the issue with these tests is that they force the older TLS versions which OpenSSL 3.0 now requires an explicit SECLEVEL=0 configuration to use.

[bneradt]

Too much duplication. I'd suggest:

cipher_suite = "The basic ones"
if openssl_version == 3
  cipher_suite += ":@SECLEVEL=0"
endif

and

'proxy.config.ssl.server.cipher_suite': '{0}'.format(cipher_suite),

Looks good. But no need for the format string. This should work just fine:

'proxy.config.ssl.server.cipher_suite': cipher_suite,

Thank you @masaori335 for updating for boringssl.

[masaori335]

Updated to reduce dups. Please take another look.

[bneradt]

Thanks for the update for OpenSSL 3.x

[zwoop]

Cherry-picked to v9.2.x