Automate MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK dependency

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-11 14:50:48 +02:00 · 2025-02-13 21:23:22 +01:00
parent 2a8acc41b2
commit 48e4ff9622
1 changed files with 5 additions and 18 deletions
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -490,6 +490,11 @@ detect_required_features() {
            requires_certificate_authentication;;
    esac

+    case " $CMD_LINE " in
+        *\ ca_callback=1\ *)
+            requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK;;
+    esac
+
    case " $CMD_LINE " in
        *"programs/ssl/dtls_client "*|\
        *"programs/ssl/ssl_client1 "*)
@@ -2254,7 +2259,6 @@ run_test    "TLS: password protected server key, two certificates" \
            "$P_CLI" \
            0

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "CA callback on client" \
            "$P_SRV debug_level=3" \
            "$P_CLI ca_callback=1 debug_level=3 " \
@@ -2263,7 +2267,6 @@ run_test    "CA callback on client" \
            -S "error" \
            -C "error"

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
 requires_hash_alg SHA_256
 run_test    "CA callback on server" \
@@ -6416,7 +6419,6 @@ run_test    "Authentication: send alt hs DN hints in CertificateRequest" \
 # Tests for auth_mode, using CA callback, these are duplicated from the authentication tests
 # When updating these tests, modify the matching authentication tests accordingly

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server badcert, client required" \
            "$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
             key_file=$DATA_FILES_PATH/server5.key" \
@@ -6428,7 +6430,6 @@ run_test    "Authentication, CA callback: server badcert, client required" \
            -c "! mbedtls_ssl_handshake returned" \
            -c "X509 - Certificate verification failed"

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server badcert, client optional" \
            "$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
             key_file=$DATA_FILES_PATH/server5.key" \
@@ -6440,7 +6441,6 @@ run_test    "Authentication, CA callback: server badcert, client optional" \
            -C "! mbedtls_ssl_handshake returned" \
            -C "X509 - Certificate verification failed"

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server badcert, client none" \
            "$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
             key_file=$DATA_FILES_PATH/server5.key" \
@@ -6459,7 +6459,6 @@ run_test    "Authentication, CA callback: server badcert, client none" \
 # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a
 # different means to have the server ignoring the client's supported curve list.

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server ECDH p256v1, client required, p256v1 unsupported" \
            "$P_SRV debug_level=1 key_file=$DATA_FILES_PATH/server5.key \
             crt_file=$DATA_FILES_PATH/server5.ku-ka.crt" \
@@ -6470,7 +6469,6 @@ run_test    "Authentication, CA callback: server ECDH p256v1, client required, p
            -c "! Certificate verification flags" \
            -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server ECDH p256v1, client optional, p256v1 unsupported" \
            "$P_SRV debug_level=1 key_file=$DATA_FILES_PATH/server5.key \
             crt_file=$DATA_FILES_PATH/server5.ku-ka.crt" \
@@ -6481,7 +6479,6 @@ run_test    "Authentication, CA callback: server ECDH p256v1, client optional, p
            -c "! Certificate verification flags"\
            -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: client SHA384, server required" \
            "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
@@ -6493,7 +6490,6 @@ run_test    "Authentication, CA callback: client SHA384, server required" \
            -c "Supported Signature Algorithm found: 04 " \
            -c "Supported Signature Algorithm found: 05 "

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
 run_test    "Authentication, CA callback: client SHA256, server required" \
            "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
@@ -6505,7 +6501,6 @@ run_test    "Authentication, CA callback: client SHA256, server required" \
            -c "Supported Signature Algorithm found: 04 " \
            -c "Supported Signature Algorithm found: 05 "

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client badcert, server required" \
            "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
            "$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-badsign.crt \
@@ -6527,7 +6522,6 @@ run_test    "Authentication, CA callback: client badcert, server required" \
 # detect that its write end of the connection is closed and abort
 # before reading the alert message.

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client cert not trusted, server required" \
            "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
            "$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-selfsigned.crt \
@@ -6545,7 +6539,6 @@ run_test    "Authentication, CA callback: client cert not trusted, server requir
            -s "! mbedtls_ssl_handshake returned" \
            -s "X509 - Certificate verification failed"

-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client badcert, server optional" \
            "$P_SRV ca_callback=1 debug_level=3 auth_mode=optional" \
            "$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-badsign.crt \
@@ -6566,7 +6559,6 @@ run_test    "Authentication, CA callback: client badcert, server optional" \

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server max_int chain, client default" \
            "$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c09.pem \
                    key_file=$DATA_FILES_PATH/dir-maxpath/09.key" \
@@ -6577,7 +6569,6 @@ run_test    "Authentication, CA callback: server max_int chain, client default"

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server max_int+1 chain, client default" \
            "$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
                    key_file=$DATA_FILES_PATH/dir-maxpath/10.key" \
@@ -6588,7 +6579,6 @@ run_test    "Authentication, CA callback: server max_int+1 chain, client default

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: server max_int+1 chain, client optional" \
            "$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
                    key_file=$DATA_FILES_PATH/dir-maxpath/10.key" \
@@ -6600,7 +6590,6 @@ run_test    "Authentication, CA callback: server max_int+1 chain, client optiona

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client max_int+1 chain, server optional" \
            "$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=optional" \
            "$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
@@ -6611,7 +6600,6 @@ run_test    "Authentication, CA callback: client max_int+1 chain, server optiona

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client max_int+1 chain, server required" \
            "$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=required" \
            "$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
@@ -6622,7 +6610,6 @@ run_test    "Authentication, CA callback: client max_int+1 chain, server require

 requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
 requires_full_size_output_buffer
-requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 run_test    "Authentication, CA callback: client max_int chain, server required" \
            "$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=required" \
            "$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c09.pem \