commit bbdc1a3575f06b1f6e84befdfb2c8ca2a85165a8
author Gilles Peskine <Gilles.Peskine@arm.com> Fri Sep 06 15:38:20 2024 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> Fri Sep 13 09:49:04 2024 +0200
tree 15b4296bca13392932507552913cd8afda40ab7a
parent 5c766dcb011e22a41c4695b2bb567d9cd3783305

Detect PSK-only mode in TLS 1.3 as well

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

tests/ssl-opt.sh

diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index e7fdfa0..4f763ab 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -604,14 +604,20 @@
     adapt_cmd_for_psk SRV_CMD "$SRV_CMD"
 }
 
-case " $CONFIGS_ENABLED " in
-    *\ MBEDTLS_KEY_EXCHANGE_[^P]*) PSK_ONLY="NO";;
-    *\ MBEDTLS_KEY_EXCHANGE_P[^S]*) PSK_ONLY="NO";;
-    *\ MBEDTLS_KEY_EXCHANGE_PS[^K]*) PSK_ONLY="NO";;
-    *\ MBEDTLS_KEY_EXCHANGE_PSK[^_]*) PSK_ONLY="NO";;
-    *\ MBEDTLS_KEY_EXCHANGE_PSK_ENABLED\ *) PSK_ONLY="YES";;
-    *) PSK_ONLY="NO";;
-esac
+# PSK_PRESENT="YES" if at least one protocol versions supports pure-PSK.
+PSK_PRESENT="NO"
+# PSK_ONLY="YES" if no key exchange is enabled except pure-PSK.
+PSK_ONLY=""
+for c in $CONFIGS_ENABLED; do
+    case $c in
+        MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) PSK_PRESENT="YES";;
+        MBEDTLS_KEY_EXCHANGE_*_ENABLED) PSK_ONLY="NO";;
+        MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) PSK_PRESENT="YES";;
+        MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_*_ENABLED) PSK_ONLY="NO";;
+    esac
+done
+: ${PSK_ONLY:=$PSK_PRESENT}
+unset c
 
 HAS_ALG_MD5="NO"
 HAS_ALG_SHA_1="NO"