lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-08 17:42:09 +03:00
Code Activity

Add negative tests for opaque mixed-PSK (client)

Browse Source 
ssl_client2.c used to check that we force a ciphersuite that worked;
that would have prevented testing so I removed it. The library should be
robust even when the application tries something that doesn't work.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard
2022-06-14 10:45:19 +02:00
committed by Manuel Pégourié-Gonnard
parent 938be422c6
commit a49a00cc24
3 changed files with 44 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
tests/ssl-opt.sh
View File

@@ -1699,6 +1699,41 @@ run_test "Opaque key: server: ECDH-RSA not supported" \
-s "error" \
-c "error"
# Opaque PSKs not supported for mixed PSK
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
run_test "Opaque psk: client: ECDHE-PSK not supported" \
"$P_SRV debug_level=1 psk=abc123 psk_identity=foo" \
"$P_CLI debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 \
force_version=tls12 \
force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA" \
1 \
-c "opaque PSK not supported with ECDHE-PSK" \
-s "error" \
-c "error"
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
run_test "Opaque psk: client: DHE-PSK not supported" \
"$P_SRV debug_level=1 psk=abc123 psk_identity=foo" \
"$P_CLI debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 \
force_version=tls12 \
force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA" \
1 \
-c "opaque PSK not supported with DHE-PSK" \
-s "error" \
-c "error"
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
run_test "Opaque psk: client: RSA-PSK not supported" \
"$P_SRV debug_level=1 psk=abc123 psk_identity=foo" \
"$P_CLI debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 \
force_version=tls12 \
force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA" \
1 \
-c "opaque PSK not supported with RSA-PSK" \
-s "error" \
-c "error"
# Test ciphersuites which we expect to be fully supported by PSA Crypto
# and check that we don't fall back to Mbed TLS' internal crypto primitives.
run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CCM