mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-05-05 09:33:01 +02:00
Automate MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK dependency
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
@@ -475,6 +475,11 @@ detect_required_features() {
|
||||
requires_certificate_authentication;;
|
||||
esac
|
||||
|
||||
case " $CMD_LINE " in
|
||||
*\ ca_callback=1\ *)
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK;;
|
||||
esac
|
||||
|
||||
case " $CMD_LINE " in
|
||||
*"programs/ssl/dtls_client "*|\
|
||||
*"programs/ssl/ssl_client1 "*)
|
||||
@@ -2217,7 +2222,6 @@ run_test "TLS: password protected server key, two certificates" \
|
||||
"$P_CLI" \
|
||||
0
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "CA callback on client" \
|
||||
"$P_SRV debug_level=3" \
|
||||
"$P_CLI ca_callback=1 debug_level=3 " \
|
||||
@@ -2226,7 +2230,6 @@ run_test "CA callback on client" \
|
||||
-S "error" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
|
||||
requires_hash_alg SHA_256
|
||||
run_test "CA callback on server" \
|
||||
@@ -6279,7 +6282,6 @@ run_test "Authentication: send alt hs DN hints in CertificateRequest" \
|
||||
# Tests for auth_mode, using CA callback, these are duplicated from the authentication tests
|
||||
# When updating these tests, modify the matching authentication tests accordingly
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server badcert, client required" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
|
||||
key_file=$DATA_FILES_PATH/server5.key" \
|
||||
@@ -6291,7 +6293,6 @@ run_test "Authentication, CA callback: server badcert, client required" \
|
||||
-c "! mbedtls_ssl_handshake returned" \
|
||||
-c "X509 - Certificate verification failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server badcert, client optional" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
|
||||
key_file=$DATA_FILES_PATH/server5.key" \
|
||||
@@ -6303,7 +6304,6 @@ run_test "Authentication, CA callback: server badcert, client optional" \
|
||||
-C "! mbedtls_ssl_handshake returned" \
|
||||
-C "X509 - Certificate verification failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server badcert, client none" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/server5-badsign.crt \
|
||||
key_file=$DATA_FILES_PATH/server5.key" \
|
||||
@@ -6322,7 +6322,6 @@ run_test "Authentication, CA callback: server badcert, client none" \
|
||||
# occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a
|
||||
# different means to have the server ignoring the client's supported curve list.
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server ECDH p256v1, client required, p256v1 unsupported" \
|
||||
"$P_SRV debug_level=1 key_file=$DATA_FILES_PATH/server5.key \
|
||||
crt_file=$DATA_FILES_PATH/server5.ku-ka.crt" \
|
||||
@@ -6333,7 +6332,6 @@ run_test "Authentication, CA callback: server ECDH p256v1, client required, p
|
||||
-c "! Certificate verification flags" \
|
||||
-C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server ECDH p256v1, client optional, p256v1 unsupported" \
|
||||
"$P_SRV debug_level=1 key_file=$DATA_FILES_PATH/server5.key \
|
||||
crt_file=$DATA_FILES_PATH/server5.ku-ka.crt" \
|
||||
@@ -6344,7 +6342,6 @@ run_test "Authentication, CA callback: server ECDH p256v1, client optional, p
|
||||
-c "! Certificate verification flags"\
|
||||
-c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
|
||||
run_test "Authentication, CA callback: client SHA384, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
|
||||
@@ -6356,7 +6353,6 @@ run_test "Authentication, CA callback: client SHA384, server required" \
|
||||
-c "Supported Signature Algorithm found: 04 " \
|
||||
-c "Supported Signature Algorithm found: 05 "
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
|
||||
run_test "Authentication, CA callback: client SHA256, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
|
||||
@@ -6368,7 +6364,6 @@ run_test "Authentication, CA callback: client SHA256, server required" \
|
||||
-c "Supported Signature Algorithm found: 04 " \
|
||||
-c "Supported Signature Algorithm found: 05 "
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client badcert, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
|
||||
"$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-badsign.crt \
|
||||
@@ -6390,7 +6385,6 @@ run_test "Authentication, CA callback: client badcert, server required" \
|
||||
# detect that its write end of the connection is closed and abort
|
||||
# before reading the alert message.
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client cert not trusted, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \
|
||||
"$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-selfsigned.crt \
|
||||
@@ -6408,7 +6402,6 @@ run_test "Authentication, CA callback: client cert not trusted, server requir
|
||||
-s "! mbedtls_ssl_handshake returned" \
|
||||
-s "X509 - Certificate verification failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client badcert, server optional" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 auth_mode=optional" \
|
||||
"$P_CLI debug_level=3 crt_file=$DATA_FILES_PATH/server5-badsign.crt \
|
||||
@@ -6429,7 +6422,6 @@ run_test "Authentication, CA callback: client badcert, server optional" \
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server max_int chain, client default" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c09.pem \
|
||||
key_file=$DATA_FILES_PATH/dir-maxpath/09.key" \
|
||||
@@ -6440,7 +6432,6 @@ run_test "Authentication, CA callback: server max_int chain, client default"
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server max_int+1 chain, client default" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
|
||||
key_file=$DATA_FILES_PATH/dir-maxpath/10.key" \
|
||||
@@ -6451,7 +6442,6 @@ run_test "Authentication, CA callback: server max_int+1 chain, client default
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: server max_int+1 chain, client optional" \
|
||||
"$P_SRV crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
|
||||
key_file=$DATA_FILES_PATH/dir-maxpath/10.key" \
|
||||
@@ -6463,7 +6453,6 @@ run_test "Authentication, CA callback: server max_int+1 chain, client optiona
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client max_int+1 chain, server optional" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=optional" \
|
||||
"$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
|
||||
@@ -6474,7 +6463,6 @@ run_test "Authentication, CA callback: client max_int+1 chain, server optiona
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client max_int+1 chain, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=required" \
|
||||
"$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c10.pem \
|
||||
@@ -6485,7 +6473,6 @@ run_test "Authentication, CA callback: client max_int+1 chain, server require
|
||||
|
||||
requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA
|
||||
requires_full_size_output_buffer
|
||||
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
|
||||
run_test "Authentication, CA callback: client max_int chain, server required" \
|
||||
"$P_SRV ca_callback=1 debug_level=3 ca_file=$DATA_FILES_PATH/dir-maxpath/00.crt auth_mode=required" \
|
||||
"$P_CLI crt_file=$DATA_FILES_PATH/dir-maxpath/c09.pem \
|
||||
|
||||
Reference in New Issue
Block a user