mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-09-13 14:22:19 +08:00
fb2ce055a3
There was a discrepancy between how `mbedtls_test_ssl_endpoint_init()` and `mbedtls_test_ssl_perform_handshake()` handled client authentication: `mbedtls_test_ssl_endpoint_init()` defaulted to `MBEDTLS_SSL_VERIFY_REQUIRED` on both sides, whereas `mbedtls_test_ssl_perform_handshake()` obeyed `options->srv_auth_mode` which defaulted to no verification of the client certificate. Make this more uniform. Now `mbedtls_test_ssl_endpoint_init()` obeys `options->srv_auth_mode` on servers (still forcing verification on clients, which is the library default anyway). Also, `options->srv_auth_mode` is now enabled by default. Thus: * Tests that call `mbedtls_test_ssl_perform_handshake()` now perform client certificate verification, unless they disable it explicitly. * Tests that call `mbedtls_test_ssl_endpoint_init()` on a server are unchanged. (They would change if they were setting `options->srv_auth_mode` explicitly, which previously was ignored, but no test function did this.) This means that a few test functions now perform client certificate verification whereas they previously don't. This is harmless except in `handshake_ciphersuite_select`, where one test case `Handshake, select ECDH-RSA-WITH-AES-256-CBC-SHA384, opaque` fails with client authentication because the test code doesn't deal with the weirdness of static ECDH correctly with respect to client authentication. So keep the previous behavior in `handshake_ciphersuite_select`, by explicitly turning off client authentication. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com> |
||
|---|---|---|
| .. | ||
| test_suite_config.function | ||
| test_suite_config.tls_combinations.data | ||
| test_suite_constant_time_hmac.data | ||
| test_suite_constant_time_hmac.function | ||
| test_suite_debug.data | ||
| test_suite_debug.function | ||
| test_suite_error.data | ||
| test_suite_error.function | ||
| test_suite_mps.data | ||
| test_suite_mps.function | ||
| test_suite_net.data | ||
| test_suite_net.function | ||
| test_suite_pkcs7.data | ||
| test_suite_pkcs7.function | ||
| test_suite_ssl_decrypt.function | ||
| test_suite_ssl_decrypt.misc.data | ||
| test_suite_ssl.data | ||
| test_suite_ssl.function | ||
| test_suite_ssl.records.data | ||
| test_suite_ssl.tls-defrag.data | ||
| test_suite_test_helpers.data | ||
| test_suite_test_helpers.function | ||
| test_suite_timing.data | ||
| test_suite_timing.function | ||
| test_suite_version.data | ||
| test_suite_version.function | ||
| test_suite_x509parse.data | ||
| test_suite_x509parse.function | ||
| test_suite_x509write.data | ||
| test_suite_x509write.function | ||