Tests/RunCMake/file-DOWNLOAD: Add case covering TLS_VERSION values

6 files changed, 76 insertions, 0 deletions

diff --git a/Tests/RunCMake/CMakeLists.txt b/Tests/RunCMake/CMakeLists.txt
index 29351eb..d45d70a 100644
--- a/Tests/RunCMake/CMakeLists.txt
+++ b/Tests/RunCMake/CMakeLists.txt
@@ -599,6 +599,7 @@ foreach(var
     CMake_TEST_TLS_VERIFY_URL
     CMake_TEST_TLS_VERIFY_URL_BAD
     CMake_TEST_TLS_VERSION
+    CMake_TEST_TLS_VERSION_URL_BAD
     )
   if(DEFINED ${var})
     list(APPEND file-DOWNLOAD_ARGS -D${var}=${${var}})
diff --git a/Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake b/Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake
index 2dc2de0..3fe2090 100644
--- a/Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake
+++ b/Tests/RunCMake/file-DOWNLOAD/RunCMakeTest.cmake
@@ -30,6 +30,9 @@ endif()
 if(CMake_TEST_TLS_VERIFY_URL_BAD)
   run_cmake_with_options(TLS_VERIFY-bad -Durl=${CMake_TEST_TLS_VERIFY_URL_BAD})
 endif()
+if(CMake_TEST_TLS_VERSION_URL_BAD)
+  run_cmake_with_options(TLS_VERSION-bad -Durl=${CMake_TEST_TLS_VERSION_URL_BAD})
+endif()
 
 if(CMake_TEST_TLS_VERIFY_URL)
   run_cmake_with_options(TLS_VERIFY-good -Durl=${CMake_TEST_TLS_VERIFY_URL})
diff --git a/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-darwin.txt b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-darwin.txt
new file mode 100644
index 0000000..730cf59
--- /dev/null
+++ b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-darwin.txt
@@ -0,0 +1,7 @@
+-- def-1\.1: 0;"No error"
+-- env-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- env-1\.1: 0;"No error"
+-- var-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- var-1\.1: 0;"No error"
+-- opt-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- opt-1\.1: 0;"No error"
diff --git a/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-windows.txt b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-windows.txt
new file mode 100644
index 0000000..730cf59
--- /dev/null
+++ b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout-windows.txt
@@ -0,0 +1,7 @@
+-- def-1\.1: 0;"No error"
+-- env-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- env-1\.1: 0;"No error"
+-- var-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- var-1\.1: 0;"No error"
+-- opt-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- opt-1\.1: 0;"No error"
diff --git a/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout.txt b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout.txt
new file mode 100644
index 0000000..34d99d1
--- /dev/null
+++ b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad-stdout.txt
@@ -0,0 +1,3 @@
+-- env-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- var-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
+-- opt-1\.2: (60;"SSL peer certificate or SSH remote key was not OK"|35;"SSL connect error")
diff --git a/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad.cmake b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad.cmake
new file mode 100644
index 0000000..106fe44
--- /dev/null
+++ b/Tests/RunCMake/file-DOWNLOAD/TLS_VERSION-bad.cmake
@@ -0,0 +1,55 @@
+function(download case)
+  # URL with semantics like https://tls-v1-1.badssl.com:1011 is provided by caller
+  file(DOWNLOAD ${url} ${ARGN} STATUS status LOG log)
+  message(STATUS "${case}: ${status}")
+  if(case MATCHES "1\\.2$" AND NOT status MATCHES "^(35|60);")
+    message("${log}")
+  endif()
+endfunction()
+
+set(CMAKE_TLS_VERIFY 1)
+
+if(CMAKE_HOST_WIN32 OR CMAKE_HOST_APPLE)
+  # The OS-native TLS implementations support TLS 1.1.
+  set(TEST_TLSv1_1 1)
+else()
+  # OpenSSL 3.1+ does not support TLS 1.1 or older without setting
+  # the security level to 0, which curl (correctly) does not do.
+  # https://openssl-library.org/news/openssl-3.1-notes/index.html#major-changes-between-openssl-30-and-openssl-310-14-mar-2023
+  set(TEST_TLSv1_1 0)
+endif()
+
+if(TEST_TLSv1_1)
+  # The default is to allow 1.1.
+  unset(ENV{CMAKE_TLS_VERSION})
+  unset(CMAKE_TLS_VERSION)
+  download(def-1.1)
+endif()
+
+# The environment variable overrides the default.
+set(ENV{CMAKE_TLS_VERSION} 1.2)
+download(env-1.2)
+if(TEST_TLSv1_1)
+  set(ENV{CMAKE_TLS_VERSION} 1.1)
+  download(env-1.1)
+endif()
+
+# The cmake variable overrides the environment variable.
+set(ENV{CMAKE_TLS_VERSION} 1.1)
+set(CMAKE_TLS_VERSION 1.2)
+download(var-1.2)
+if(TEST_TLSv1_1)
+  set(ENV{CMAKE_TLS_VERSION} 1.2)
+  set(CMAKE_TLS_VERSION 1.1)
+  download(var-1.1)
+endif()
+
+# The explicit argument overrides the cmake variable and the environment variable.
+set(ENV{CMAKE_TLS_VERSION} 1.1)
+set(CMAKE_TLS_VERSION 1.1)
+download(opt-1.2 TLS_VERSION 1.2)
+if(TEST_TLSv1_1)
+  set(ENV{CMAKE_TLS_VERSION} 1.2)
+  set(CMAKE_TLS_VERSION 1.2)
+  download(opt-1.1 TLS_VERSION 1.1)
+endif()