lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-05 19:35:48 +03:00
Code Activity

ssl-opt.sh: Change G->m server version selection tests

Browse Source 
Change description and dependencies before
to expand G->m server version selection tests.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
2024-03-06 15:00:42 +01:00
parent cd1370e8d8
commit 98bdcc4f29
1 changed files with 33 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
tests/ssl-opt.sh
View File

@@ -6884,43 +6884,35 @@ run_test "Version check: all -> 1.2" \
# Tests of version negotiation on server side against GnuTLS client # Tests of version negotiation on server side against GnuTLS client
requires_gnutls_tls1_3
requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_SRV_C
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_3 requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_3
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
run_test "Server selecting TLS 1.2" \ run_test "Server version nego check G->m: 1.2+1.3 / 1.2 -> 1.2" \
"$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \ "$P_SRV" \
"$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" \ "$G_NEXT_CLI localhost --priority=NORMAL" \
0 \ 0 \
-s "Protocol is TLSv1.2" \ -S "mbedtls_ssl_handshake returned" \
-c "HTTP/1.0 200 OK" -s "Protocol is TLSv1.2"
requires_gnutls_tls1_3 requires_all_configs_enabled MBEDTLS_SSL_SRV_C MBEDTLS_SSL_PROTO_TLS1_3 \
requires_config_enabled MBEDTLS_DEBUG_C MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
requires_config_enabled MBEDTLS_SSL_SRV_C MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 run_test "Server version nego check G->m: 1.2+1.3 / (1.2)+1.3 -> 1.3" \
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED "$P_SRV" \
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE "$G_NEXT_CLI localhost --priority=NORMAL" \
run_test "Server selecting TLS 1.3, over TLS 1.2 if supported - compat mode enabled" \
"$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \
"$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" \
0 \ 0 \
-s "Protocol is TLSv1.3" \ -S "mbedtls_ssl_handshake returned" \
-c "HTTP/1.0 200 OK" -s "Protocol is TLSv1.3"
requires_gnutls_tls1_3 requires_gnutls_next_disable_tls13_compat
requires_config_enabled MBEDTLS_DEBUG_C requires_all_configs_enabled MBEDTLS_SSL_SRV_C MBEDTLS_SSL_PROTO_TLS1_3 \
requires_config_enabled MBEDTLS_SSL_SRV_C MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 run_test "Server version nego check G->m (no compat): 1.2+1.3 / (1.2)+1.3 -> 1.3" \
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED "$P_SRV" \
run_test "Server selecting TLS 1.3, over TLS 1.2 if supported" \ "$G_NEXT_CLI localhost --priority=NORMAL:%DISABLE_TLS13_COMPAT_MODE" \
"$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \
"$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2:%DISABLE_TLS13_COMPAT_MODE" \
0 \ 0 \
-s "Protocol is TLSv1.3" \ -S "mbedtls_ssl_handshake returned" \
-c "HTTP/1.0 200 OK" -s "Protocol is TLSv1.3"
# GnuTLS can be setup to send a ClientHello containing a supported versions # GnuTLS can be setup to send a ClientHello containing a supported versions
# extension proposing TLS 1.2 (preferred) and then TLS 1.3. In that case, # extension proposing TLS 1.2 (preferred) and then TLS 1.3. In that case,
@@ -6930,37 +6922,30 @@ run_test "Server selecting TLS 1.3, over TLS 1.2 if supported" \
# if TLS 1.2 was its preferred version. Keeping the test even if the # if TLS 1.2 was its preferred version. Keeping the test even if the
# handshake fails eventually as it exercices parts of the Mbed TLS # handshake fails eventually as it exercices parts of the Mbed TLS
# implementation that are otherwise not exercised. # implementation that are otherwise not exercised.
requires_gnutls_tls1_3 requires_all_configs_enabled MBEDTLS_SSL_SRV_C \
requires_config_enabled MBEDTLS_DEBUG_C MBEDTLS_SSL_PROTO_TLS1_2 MBEDTLS_SSL_PROTO_TLS1_3 \
requires_config_enabled MBEDTLS_SSL_SRV_C MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 run_test "Server version nego check G->m: [1.2]+1.3 / 1.2+1.3 -> 1.2" \
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 "$P_SRV" \
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
run_test "Server selecting TLS 1.2 over TLS 1.3" \
"$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \
"$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" \ "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" \
1 \ 1 \
-c "Detected downgrade to TLS 1.2 from TLS 1.3" -c "Detected downgrade to TLS 1.2 from TLS 1.3"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "Not supported version check: cli TLS 1.0" \ run_test "Not supported version check G->m: 1.0 / (1.2)+(1.3)" \
"$P_SRV" \ "$P_SRV" \
"$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.0" \ "$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.0" \
1 \ 1 \
-s "Handshake protocol not within min/max boundaries" \ -s "Handshake protocol not within min/max boundaries" \
-c "Error in protocol version" \ -S "Protocol is TLSv1.0"
-S "Protocol is TLSv1.0" \
-C "Handshake was completed"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_SRV_C
run_test "Not supported version check: cli TLS 1.1" \ run_test "Not supported version check G->m: 1.1 / (1.2)+(1.3)" \
"$P_SRV" \ "$P_SRV" \
"$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.1" \ "$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.1" \
1 \ 1 \
-s "Handshake protocol not within min/max boundaries" \ -s "Handshake protocol not within min/max boundaries" \
-c "Error in protocol version" \ -S "Protocol is TLSv1.1"
-S "Protocol is TLSv1.1" \
-C "Handshake was completed"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "Not supported version check: srv max TLS 1.0" \ run_test "Not supported version check: srv max TLS 1.0" \