From 060e284deea9262d9ecb359ffc4a56ac294e01e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 5 Aug 2024 11:10:47 +0200 Subject: [PATCH] Add test forcing TLS 1.2 for clearer coverage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a duplicate from the previous test, except it forces TLS 1.2. The previous test does not force a version, so it picks 1.3 in the default/full config. However we have a build with 1.2 only in all.sh, in which the previous test would pick 1.2. So, there was no test gap and the behaviour was indeed tested with 1.2. However when measuring code coverage with lcov, currently we can only use a single build. So, I'm adding this variant of the test case as a so that the 1.2 code looks covered in the report from basic-build-test.sh. This is for my convenience while I make sure everything is covered before refactoring. Signed-off-by: Manuel Pégourié-Gonnard --- tests/ssl-opt.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 91828ef03a..7de41da994 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -5853,6 +5853,17 @@ run_test "Authentication: server goodcert, client required, no trusted CA" \ -c "! mbedtls_ssl_handshake returned" \ -c "SSL - No CA Chain is set, but required to operate" +requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT +run_test "Authentication: server goodcert, client required, no trusted CA (1.2)" \ + "$P_SRV force_version=tls12" \ + "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \ + 1 \ + -c "x509_verify_cert() returned" \ + -c "! The certificate is not correctly signed by the trusted CA" \ + -c "! Certificate verification flags"\ + -c "! mbedtls_ssl_handshake returned" \ + -c "SSL - No CA Chain is set, but required to operate" + # The purpose of the next two tests is to test the client's behaviour when receiving a server # certificate with an unsupported elliptic curve. This should usually not happen because # the client informs the server about the supported curves - it does, though, in the