From e3eab32600f1af22b934109782ca252ad5e45e3d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 10 Sep 2024 12:24:23 +0200 Subject: [PATCH] requires_certificate_authentication: prioritize TLS 1.3 When checking whether the build supports certificate authentication, check the key exchange modes enabled in the default protocol version. This is TLS 1.3 when it's enabled. Signed-off-by: Gilles Peskine --- tests/ssl-opt.sh | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 08f78e117f..beb9aa5925 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -326,12 +326,13 @@ TLS1_2_KEY_EXCHANGES_WITH_CERT_WO_ECDH="MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \ MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED" requires_certificate_authentication () { - if is_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 + if is_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 then + # TLS 1.3 is negotiated by default, so check whether it supports + # certificate-based authentication. + requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED + else # Only TLS 1.2 is enabled. requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT - elif ! is_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED - then - SKIP_NEXT="YES" fi }