From 00de317aad4699f3bec014fc82ca1330e0fb8ab0 Mon Sep 17 00:00:00 2001
From: Tobias Frauenschlaeger <tobias@wolfssl.com>
Date: Sat, 22 Aug 2026 22:02:02 +0000
Subject: [PATCH] Guard the unit tests that need TLS 1.2 on WOLFSSL_NO_TLS12

test_tls13_downgrade_sentinel() builds a TLS 1.2 server, and a TLS 1.1 one when
old TLS is enabled, to make the peer produce the downgrade sentinel a TLS 1.3
client has to reject. Its guard did not mention WOLFSSL_NO_TLS12, so a build
without TLS 1.2 failed to compile the unit tests at wolfTLSv1_2_server_method().

There is nothing to downgrade to in such a build, so require TLS 1.2 for the
whole test. It still runs everywhere it did before.

The status_request_v2 block at the end of test_TLSX_CSR_parse() builds a TLS 1.2
server context the same way and was guarded only on the extension. RFC 6961 is
defined for TLS 1.2 and below, so require TLS 1.2 there too.

test_tls13_bounds.c has the opposite problem. Its file-level guard requires TLS
1.2 for the legacy-version tests, but the four test_tls13_mutual_auth_* entry
points that call test_tls13b_mutual_auth_round() do not, so a build without TLS
1.2 could not link them. Those handshakes are pure TLS 1.3, so the helper moves
into its own block without the TLS 1.2 condition rather than being skipped, and
now runs in such a build. The key-type condition on the new block keeps it from
going unused where none of the four callers compile.
---
 tests/api/test_tls13.c        |  4 +++-
 tests/api/test_tls13_bounds.c | 10 ++++++++++
 tests/api/test_tls_parse.c    |  2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c
index b387e5beb9..9b136a6bee 100644
--- a/tests/api/test_tls13.c
+++ b/tests/api/test_tls13.c
@@ -9243,7 +9243,9 @@ int test_tls13_post_handshake_auth_late_allow(void)
 int test_tls13_downgrade_sentinel(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_TLS13) && \
+/* The sentinel marks a downgrade to TLS 1.2 or below, so the test needs a
+ * server of that version to produce one. */
+#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_NO_TLS12) && \
     defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && \
     !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)
     WOLFSSL_CTX *ctx_c = NULL;
diff --git a/tests/api/test_tls13_bounds.c b/tests/api/test_tls13_bounds.c
index 054ccb4f8b..ba503e82ab 100644
--- a/tests/api/test_tls13_bounds.c
+++ b/tests/api/test_tls13_bounds.c
@@ -417,6 +417,16 @@ static int test_tls13b_ch_find_ext(const byte* rec, int rec_sz, word16 type,
     }
     return -1;
 }
+
+#endif /* guards */
+
+#if defined(WOLFSSL_TLS13) && \
+    defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && \
+    !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
+    !defined(NO_CERTS) && !defined(NO_FILESYSTEM) && \
+    (!defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
+     defined(HAVE_ED448))
+
 /* A mutually authenticated TLS 1.3 handshake with a chosen key type on both
  * ends. DoTls13CertificateVerify()'s peer-key / peerSigAlgo dispatch has one
  * arm per algorithm and the group only ever ran the RSA one, so each arm's
diff --git a/tests/api/test_tls_parse.c b/tests/api/test_tls_parse.c
index baff3de2ee..863ae6f3d9 100644
--- a/tests/api/test_tls_parse.c
+++ b/tests/api/test_tls_parse.c
@@ -1395,7 +1395,7 @@ int test_TLSX_CSR_parse(void)
 #endif
 
 #if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && !defined(NO_TLS) && \
-    !defined(NO_WOLFSSL_SERVER)
+    !defined(NO_WOLFSSL_SERVER) && !defined(WOLFSSL_NO_TLS12)
     {
         WOLFSSL_CTX* ctx2 = test_tls_parse_server_ctx(
                 wolfTLSv1_2_server_method());