0.34.9

src/config/tests.rs

@@ -749,10 +749,27 @@ mod tests {
             tls12: true,
             tls13: false,
             cipher_suites: vec![],
+            post_quantum: false,
         });
         assert!(compile(c, 1, &policy()).is_ok());
     }
 
+    #[test]
+    fn pqc_vhost_override_requires_global_opt_in_and_can_opt_out() {
+        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+        config.vhosts[0].tls_policy = Some(crate::tls::ProtocolPolicy {
+            post_quantum: true,
+            ..crate::tls::ProtocolPolicy::default()
+        });
+        assert!(compile(config.clone(), 1, &policy()).is_err());
+        config.tls.policy.post_quantum = true;
+        assert!(compile(config.clone(), 1, &policy()).is_ok());
+        config.vhosts[0].tls_policy = Some(crate::tls::ProtocolPolicy::default());
+        assert!(compile(config.clone(), 1, &policy()).is_ok());
+        config.tls.policy.post_quantum = false;
+        assert!(compile(config, 1, &policy()).is_ok());
+    }
+
     #[test]
     fn persisted_remote_administration_requires_tls() {
         let mut c = demo_config("127.0.0.1:9000".parse().unwrap());