TlsLib Unit Tests#1747
Merged
Flickdm merged 2 commits intomicrosoft:release/202511from Apr 30, 2026
Merged
Conversation
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
5 times, most recently
from
febab6c to
8975eb2
Compare
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
from
8975eb2 to
5e6492d
Compare
Contributor
⏩ QEMU Validation SkippedThe PR was merged before validation completed. This comment was automatically generated by the Mu QEMU PR Validation workflow. |
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
6 times, most recently
from
07d0658 to
16153f7
Compare
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
from
16153f7 to
a2590c4
Compare
5 tasks
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
from
a2590c4 to
16153f7
Compare
apop5
approved these changes
Apr 30, 2026
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
2 times, most recently
from
d395a11 to
9b31cb0
Compare
Add provider-agnostic TlsLib unit tests that validate TLS functionality through the BaseCryptLib API surface. The test suite contains 50 test cases organized across 6 suites: - Function pointer availability (TlsInitialize, TlsCtxNew, TlsNew) - Context lifecycle (create/free, endpoint, version setting) and firmware client-only assertion (server mode returns EFI_UNSUPPORTED) - Cipher suite validation including DFCI/Intune required ciphers (ECDHE-RSA-AES-256/128-GCM/CBC), TLS 1.2 enumeration (14 ciphers), EC curve probing (P-256, P-384, P-521, X25519, X448), TLS 1.3 cipher probing, and PQC hybrid key exchange group probing (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) - Configuration tests (verify mode, hostname, SNI, session ID, signature algorithms, compression, security level, shutdown) - Certificate management (CA cert set/get, host cert, private key, CRL) - Getter/query tests (version, connection end, cipher, compression, verify, session ID, client/server random, key material) Signed-off-by: Doug Flick <dougflick@microsoft.com>
Add TestTlsLibApp.inf as a UEFI_APPLICATION and UnitTestMain.c as the DXE entry point so the TlsLib unit tests can run in the UEFI Shell environment. Update CryptoPkg.dsc to include the new test application with OneCrypto library class overrides. Signed-off-by: Doug Flick <dougflick@microsoft.com>
Flickdm
force-pushed
the
feat/TlsLibUnitTest
branch
from
9b31cb0 to
fb7763f
Compare
vineelko
approved these changes
Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Included in: MU_CRYPTO_RELEASE Milestone 1
Description
Add unit tests for the TlsLib library class. The test suite validates TLS functionality through the TlsLib API surface. Today there are no unit tests.
The goal with this is to catch regressions as we move through faster crypto changes. Importantly this prints which TLS algorithms are being used to catch regressions against DFCI or other features.
What's included
50 test cases across 6 test suites, with both host-based and UEFI Shell entry points:
Key features
SUPPORTED/UNSUPPORTEDstatus for all probed algorithms, suitable for CI action consumptionEFI_UNSUPPORTED(client-only policy) and TLS compression is disabled (CRIME attack mitigation)Code coverage
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
How This Was Tested
This will be added as a automation for MU_CRYPTO_RELEASE on changes to the OpensslPkg and TlsLib
Integration Instructions
N/A