Consider adding additional context to TLS server test names

[duncangreene]

What is the problem your feature is trying to solve?
Multiple services on a device can run using differing versions of TLS. For example on a single device, the version and ciphers used by MQTT/TLS may be completely different from the version and ciphers used by HTTP/TLS.

The below shows a device that offers TLS v1.2 and TLS v1.3 on port 8009, but only TLS v1.2 on port 8443.

By the looks of the code I believe the security.tls.v*_*_server tests are specifically targeted at the service listening on port 443 on the DUT, and I wonder whether there would be merit in tightening the test name to reflect this? It may avoid the user incorrectly assuming that all services on the DUT offer 'TLS v1.3' when they read the result in the report for security.tls.v1_3_server (which as we can see above for 8443, isn't the case).

Describe the solution you think would solve the problem
Consider renaming to security.tcp443.tls.v*_*_server or similar.

Additional context
This would provide extensibility in the test namespace for additional TLS server tests to be carried out and individually reported against other ports.

• security.tcp443.tls.v1_2_server
• security.tcp443.tls.v1_3_server
• security.tcp993.tls.v1_2_server
• security.tcp993.tls.v1_3_server
• security.tcp8443.tls.v1_2_server
• security.tcp8443.tls.v1_3_server
• security.tcp8883.tls.v1_2_server
• security.tcp8883.tls.v1_3_server

[jboddey]

I agree that we need to consider varying TLS implementations for different services - I am not sure the proposed test names are the right way of going about it - I will think further on another solution.

[jboddey]

I think the solution for this would be a generic tls test which would result non-compliant if there were any TLS service that was considered non-compliant. The module report would then give you the information we want.

[jboddey]

The TLS tests are being modified to specify the port numbers of invalid tls services. The test names will remain the same.

[duncangreene]

@jboddey @jhughesoti Just on this subject, in 2.1.1 at least, am I correct in saying that the security.tls.v*_*_server tests are only testing/reporting against ports found to offer HTTP/TLS?

That is, other ports offering services over TLS such as MQTT/TLS are not tested/reported on by the security.tls.v*_*_server tests?

[jboddey]

Correct, just HTTP/TLS.

[KrystsinaT]

The ticket 424366243 has been created.