lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Allow no authentication of the server in 1.3

Browse Source 
See notes about optional two commits ago for why we're doing this.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard
2024-08-14 10:44:02 +02:00
parent a0a781eadd
commit 2b98a4ee3b
2 changed files with 46 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
tests/ssl-opt.sh
View File

@ -5861,6 +5861,17 @@ run_test "Authentication: server badcert, client optional (1.2)" \
-C "X509 - Certificate verification failed"
run_test "Authentication: server badcert, client none" \
"$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
key_file=$DATA_FILES_PATH/server5.key" \
"$P_CLI debug_level=3 auth_mode=none" \
0 \
-C "x509_verify_cert() returned" \
-C "! The certificate is not correctly signed by the trusted CA" \
-C "! mbedtls_ssl_handshake returned" \
-C "send alert level=2 message=48" \
-C "X509 - Certificate verification failed"
run_test "Authentication: server badcert, client none (1.2)" \
"$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
key_file=$DATA_FILES_PATH/server5.key" \
"$P_CLI force_version=tls12 debug_level=3 auth_mode=none" \
@ -5917,7 +5928,29 @@ run_test "Authentication: server goodcert, client optional, no trusted CA (1.
-C "X509 - Certificate verification failed" \
-C "SSL - No CA Chain is set, but required to operate"
# TODO: server goodcert, client none, no trusted CA
requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
run_test "Authentication: server goodcert, client none, no trusted CA" \
"$P_SRV" \
"$P_CLI debug_level=3 auth_mode=none ca_file=none ca_path=none" \
0 \
-C "x509_verify_cert() returned" \
-C "! The certificate is not correctly signed by the trusted CA" \
-C "! Certificate verification flags"\
-C "! mbedtls_ssl_handshake returned" \
-C "X509 - Certificate verification failed" \
-C "SSL - No CA Chain is set, but required to operate"
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
run_test "Authentication: server goodcert, client none, no trusted CA (1.2)" \
"$P_SRV" \
"$P_CLI force_version=tls12 debug_level=3 auth_mode=none ca_file=none ca_path=none" \
0 \
-C "x509_verify_cert() returned" \
-C "! The certificate is not correctly signed by the trusted CA" \
-C "! Certificate verification flags"\
-C "! mbedtls_ssl_handshake returned" \
-C "X509 - Certificate verification failed" \
-C "SSL - No CA Chain is set, but required to operate"
# The purpose of the next two tests is to test the client's behaviour when receiving a server
# certificate with an unsupported elliptic curve. This should usually not happen because