From bd28acf24004e548c9e8c5825f49d1a08b75024e Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Thu, 10 Jul 2025 09:53:50 +0200 Subject: [PATCH] ssl-opt.sh: Remove dependencies on built-in CBC and AES Remove dependencies on MBEDTLS_CIPHER_MODE_CBC and MBEDTLS_AES_C, as these options will no longer be available once they are removed from the configuration. The affected tests rely on the built-in CBC and AES implementations. With the removal of MBEDTLS_CIPHER_MODE_CBC and MBEDTLS_AES_C as configuration options, there is no longer a mechanism in ssl-opt.sh to express these dependencies. As a result, filter out these tests at the all.sh component level when the built-in CBC and AES implementations are not available. Signed-off-by: Ronald Cron --- .../components-configuration-crypto.sh | 6 ++++-- tests/ssl-opt.sh | 21 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh index 9de7597c1c..f7eb6d617f 100644 --- a/tests/scripts/components-configuration-crypto.sh +++ b/tests/scripts/components-configuration-crypto.sh @@ -1894,7 +1894,8 @@ component_test_psa_crypto_config_accel_cipher_aead_cmac () { make test msg "ssl-opt: full config with accelerated cipher inc. AEAD and CMAC" - tests/ssl-opt.sh + # Exclude password-protected key tests — they require built-in CBC and AES. + tests/ssl-opt.sh -e "TLS: password protected" msg "compat.sh: full config with accelerated cipher inc. AEAD and CMAC" tests/compat.sh -V NO -p mbedTLS @@ -1910,7 +1911,8 @@ component_test_psa_crypto_config_reference_cipher_aead_cmac () { make test msg "ssl-opt: full config with non-accelerated cipher inc. AEAD and CMAC" - tests/ssl-opt.sh + # Exclude password-protected key tests as in test_psa_crypto_config_accel_cipher_aead_cmac. + tests/ssl-opt.sh -e "TLS: password protected" msg "compat.sh: full config with non-accelerated cipher inc. AEAD and CMAC" tests/compat.sh -V NO -p mbedTLS diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 5b2425bf55..5b7bb517c6 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -2245,9 +2245,10 @@ run_test "key size: TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ requires_config_enabled MBEDTLS_X509_CRT_PARSE_C # server5.key.enc is in PEM format and AES-256-CBC crypted. Unfortunately PEM -# module does not support PSA dispatching so we need builtin support. -requires_config_enabled MBEDTLS_CIPHER_MODE_CBC -requires_config_enabled MBEDTLS_AES_C +# module does not support PSA dispatching so we need builtin support. With the +# removal of the legacy cryptography configuration options, there is currently +# no way to express this dependency. This test fails if run in a configuration +# where the built-in implementation of CBC or AES is not present. requires_hash_alg MD5 requires_hash_alg SHA_256 run_test "TLS: password protected client key" \ @@ -2257,9 +2258,10 @@ run_test "TLS: password protected client key" \ requires_config_enabled MBEDTLS_X509_CRT_PARSE_C # server5.key.enc is in PEM format and AES-256-CBC crypted. Unfortunately PEM -# module does not support PSA dispatching so we need builtin support. -requires_config_enabled MBEDTLS_CIPHER_MODE_CBC -requires_config_enabled MBEDTLS_AES_C +# module does not support PSA dispatching so we need builtin support. With the +# removal of the legacy cryptography configuration options, there is currently +# no way to express this dependency. This test fails if run in a configuration +# where the built-in implementation of CBC or AES is not present. requires_hash_alg MD5 requires_hash_alg SHA_256 run_test "TLS: password protected server key" \ @@ -2270,9 +2272,10 @@ run_test "TLS: password protected server key" \ requires_config_enabled MBEDTLS_X509_CRT_PARSE_C requires_config_enabled MBEDTLS_RSA_C # server5.key.enc is in PEM format and AES-256-CBC crypted. Unfortunately PEM -# module does not support PSA dispatching so we need builtin support. -requires_config_enabled MBEDTLS_CIPHER_MODE_CBC -requires_config_enabled MBEDTLS_AES_C +# module does not support PSA dispatching so we need builtin support. With the +# removal of the legacy cryptography configuration options, there is currently +# no way to express this dependency. This test fails if run in a configuration +# where the built-in implementation of CBC or AES is not present. requires_hash_alg MD5 requires_hash_alg SHA_256 run_test "TLS: password protected server key, two certificates" \