{
    "DisabledTests": {
        "####################":"####################",
        "### Failures due to Bogo/NSS specifics":"",
        "####################":"####################",

        "SendEmptyRecords":"Bogo allows only 32 empty records to be sent before other TLS messages.",
        "SendUserCanceledAlerts-TooMany-TLS13":"Bogo allows only 5 user canceled alerts to be sent.",
        "SendWarningAlerts-TooMany":"Bogo allows only 5 warning alerts to be sent.",
        "TooManyKeyUpdates":"Bogo allows only 32 KeyUpdate messages to be sent.",
        "UnsolicitedServerNameAck-TLS*":"Boring wants us to fail with an unexpected_extension alert, we simply ignore ssl_server_name_xtn.",
        "DuplicateCertCompressionExt*":"BoGo expects that an alert is sent if more than one compression algorithm is sent.",
        "NoSupportedCurves":"This tests a non-spec behavior for TLS 1.2",
        "SkipEarlyData-*TooMuchData*":"Test of internal BoGo features (see Bug 1339373).",
        "Client-RejectJDK11DowngradeRandom":"This random is not specified in RFC8446.",
        "Renegotiate-Server-Forbidden":"TLS 1.2 test, renegotiation is allowed in NSS.",
        "EmptySessionID-TLS13":"This test also asserts BoringSSL always sending CCS messages for compatibility mode.",
        "Server-JDK11-NoWorkaround-3":"Unexpected Bogo crash.",
        "Resume-Server-UnofferedCipher-TLS13":"Bogo rejects resumption if client offers previously not used ciphersuites with equal hash algorithm (no 0Rtt).",
        "EarlyData-FirstTicket-Server-TLS13":"Bogo provides specific early data logging which is the only check in this test but not supported by NSS.",

        "CheckLeafCurve":"NSS doesn't require ECDSA curve to match ECDH curve",
        "UnsupportedCurve":"NSS doesn't require ECDSA curve to match ECDH curve",
        "Client-VerifyDefault-ECDSA_P521_SHA512-*":"Boring expects a failure because it doesn't enable ECDSA_P521_SHA512 by default",
        "Client-VerifyDefault-ECDSA_SHA1-TLS12":"Boring expects a failure because it doesn't enable ECDSA_SHA1 by default",

        "CurveTest-*-P-224-*":"NSS does not support P-224",
        "*-*-*ECDSA_P224_SHA256-TLS12": "NSS does not support P-224",
        "*Ed25519*":"Add Ed25519 support (Bug 1325335)",
        "SendExtensionOnClientCertificate-TLS13":"Bug 1339392",
        "CheckRecordVersion-TLS1":"NSS doesn't check record version field. Bug 1317634",
        "CheckRecordVersion-TLS11":"NSS doesn't check record version field. Bug 1317634",
        "CheckRecordVersion-TLS12":"NSS doesn't check record version field. Bug 1317634",
        "GarbageInitialRecordVersion-TLS*":"NSS doesn't strictly check the ClientHello record version.",
        "DuplicateKeyShares*":"NSS doesn't check for duplicates. Bug 1304578",
        "PointFormat-Client-MissingUncompressed":"NSS ignores ec_point_formats extensions sent by servers.",
        "SkipEarlyData-Interleaved-TLS13":"NSS ignores invalid early data records by default since ssl_0rtt_ignore_trial is default. Bug 1336916",
        "ECDSAKeyUsage*":"NSS only checks KeyUsage on server setup and with delegated credential verification. Bug 1338194",
        "RSAKeyUsage-*-WantSignature-GotEncipherment-*":"NSS only checks KeyUsage on server setup and with delegated credential verification. See Bug 1338194",
        "RSAKeyUsage-*-WantEncipherment-GotSignature-*":"NSS only checks KeyUsage on server setup and with delegated credential verification. See Bug 1338194",
        "TLS13-ExpectNoSessionTicketOnBadKEMode-Server":"NSS Server side bug. Don't send ticket when not permitted by KE modes (Bug 1317635)",
        "Resume-Server-OmitPSKsOnSecondClientHello":"NSS Server side bug. It does not detect ClientHello dropping of PSK extension (after HRR).",
        "Renegotiate-Client-Forbidden-1":"By default NSS allows renegotiation with extension contrary to bogo.",
        "TrailingData*":"NSS does only check for trailing data on possible key change handshake messages in TLS 1.3",
        "Partial*":"See TrailingData* description.",
        "QUIC-ECH*":"NSS does not support QUIC.",
        "*ECH*SkipInvalidPublicName*":"NSS allows hostnames to include underscores in contrary to the spec. Bug 1136616",
        "*ECH*CompressSupportedVersions":"NSS never compresses supported versions, Bogo does if CHOuter is TLS 1.3 only (equal to CHInner).",
        "*ECH*NoSupportedConfigs*":"NSS throws error if unsupported but well formed retry configs could not be set on client, Bogo just does not offer ECH.",
        "*ECH*RandomHRR*":"NSS sends real ECH in CH2 after receiving HRR rejcting ECH formally, Bogo expects instant ech_required alert. Bug 1779357",
        "*ECH*UnsolicitedInnerServerNameAck":"NSS always sends SNI in CHInner, Bogo tests if the client detects an unsolicited SNI in SH if CHInner did not include it. Bug 1781224",
        "CorruptTicket-TLS-TLS12":"NSS sends an alert on reception of a corrupted session ticket instead of falling back to full handshake. Bug 1783812",

        "FalseStart-ALPN*":"TODO - Implementing TLS 1.2 only FalseStart has low priority.",
        "CertCompressionPriority-TLS13" : "The preference setting used in NSS: the first advertised supported compression algorithm.",

        "Server-Verify*":"Runner doesn't set the appropriate cert-file and key-file arguments",
        "Client-Sign-Negotiate-*":"Runner doesn't set the appropriate cert-file and key-file arguments",

        "NotJustKyberKeyShare":"Boring always sends a pre-quantum share with Xyber768 (if one is configured)",
        "KyberKeyShareIncludedSecond":"Boring sends Xyber768 even if is not the client's first preference",
        "KyberKeyShareIncludedThird":"Boring sends Xyber768 even if is not the client's first preference",

        "NoCommonSignatureAlgorithms-TLS12-Fallback":"Boring will consider RSA key exchange if a common signature algorithm cannot be found",

        "Server-Sign*ML-DSA-*-TLS13":"NSS doesn't support ML-DSA for TLS 1.3.",

        "RejectEmptyCertificateAuthorities-Server-TLS-TLS13":"NSS doesn't reject an empty CertificateAuthorities extension.",
        "ExtensionTrailingData-CertificateAuthorities-Server-TLS-TLS13":"NSS doesn't reject trailing data after the CertificateAuthorities extension.",
        "ExtensionTrailingData-ServerName-Server-TLS-TLS*":"NSS doesn't reject trailing data after the ServerName extension.",
        "TrustAnchors-EmptyID-ClientHello":"NSS doesn't reject empty TrustAnchor IDs in ClientHello.",
        "ExtensionTrailingData-TrustAnchors-ClientHello-Server-TLS-TLS13":"NSS doesn't reject trailing data after the TrustAnchors extension.",

        "PAKE-Extension-Duplicate":"NSS doesn't reject duplicate PAKE extensions.",

        "Resume-Server-CipherNotPreferred":"NSS selects a different cipher on resumption than expected.",
        "Resume-Server-TLS12-TLS13-TLS":"NSS rejects TLS 1.3 resumption over TLS 1.2 with the wrong alert.",

        "ServerCertificateType-Server-RejectsDefaultOnly-*":"NSS doesn't enforce certificate type negotiation restrictions.",

        "####################":"####################",
        "### TLS1/11 failures due to unsupported signature algorithms":"",
        "####################":"####################",

        "TLS1-Server-ClientAuth*":"",
        "TLS11-Server-ClientAuth*":"",
        "GarbageCertificate-Server-TLS1":"",
        "GarbageCertificate-Server-TLS11":"",
        "*Certificate-TLS1":"",
        "*Certificate-TLS11":"",
        "CorruptTicket*TLS1":"",
        "CorruptTicket*TLS11":"",
        "Resume-Server*TLS1-*":"",
        "Resume-Server*TLS11-*":"",
        "RSAKeyUsage-Server-WantSignature-GotSignature-TLS1":"Only Server side of TLS 1 fails",
        "RSAKeyUsage-Server-WantSignature-GotSignature-TLS11":"Only Server side of TLS 11 fails",

        "####################":"####################",
        "### DTLS: known NSS limitations whose TLS variants are already disabled above":"",
        "####################":"####################",

        "ExtensionTrailingData-ServerName-Server-DTLS-TLS1":"NSS doesn't reject trailing data after the ServerName extension in DTLS 1.0/1.2.",
        "ExtensionTrailingData-ServerName-Server-DTLS-TLS12":"NSS doesn't reject trailing data after the ServerName extension in DTLS 1.0/1.2.",
        "CorruptTicket-DTLS-*":"NSS sends an alert on reception of a corrupted session ticket instead of falling back to full handshake. Bug 1783812 (DTLS variant of CorruptTicket-TLS-TLS12).",
        "Resume-Server-TLS12-TLS13-DTLS":"NSS rejects TLS 1.3 resumption over TLS 1.2 with the wrong alert (DTLS variant of Resume-Server-TLS12-TLS13-TLS).",

        "####################":"####################",
        "### DTLS: DTLS-specific tests":"",
        "####################":"####################",

        "TLS13-HelloRetryRequest-Server-DTLS-Sync*":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "VersionNegotiation-Server*-TLS13-TLS13-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "VersionNegotiationExtension-TLS13-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "MinimumVersion-Server*-TLS13-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "Resume-Server-TLS13-*-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "KeyUpdate-ToServer-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "DTLS13RecordHeader-NoLength-Server":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "DTLS13RecordHeader-ShortSeqNums-Server":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "SendEmptyFragments-Padded-DTLS":"BoGo requires tight DTLS 1.3 handshake-record packing; NSS uses one record per message (RFC 9147 permits this).",
        "DTLS-ECH*":"NSS does not support ECH over DTLS.",

        "":""
    },
    "ErrorMap" : {
    }
}
