test: add test for auto DH security level meets the minimum

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15818)

diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t
index 59f364d7f73b125ce84b9993121daf8e60651cbe..b71bc01655ea29501d53e19d92b03a347d878137 100644 (file)
--- a/test/recipes/80-test_ssl_old.t
+++ b/test/recipes/80-test_ssl_old.t
@@ -520,10 +520,10 @@ sub testssl {
     subtest 'RSA/(EC)DHE/PSK tests' => sub {
        ######################################################################
 
-       plan tests => 5;
+       plan tests => 6;
 
       SKIP: {
-         skip "TLSv1.0 is not supported by this OpenSSL build", 5
+         skip "TLSv1.0 is not supported by this OpenSSL build", 6
              if $no_tls1 || $provider eq "fips";
 
        SKIP: {
@@ -549,7 +549,7 @@ sub testssl {
          }
 
        SKIP: {
-           skip "skipping PSK tests", 2
+           skip "skipping PSK tests", 3
                if ($no_psk);
 
            ok(run(test([@ssltest, "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
@@ -557,6 +557,9 @@ sub testssl {
 
            ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
               'test tls1 with PSK via BIO pair');
+
+            ok(run(test(['ssl_old_test', '-psk', '0102030405', '-cipher', '@SECLEVEL=2:DHE-PSK-AES128-CCM'])),
+               'test auto DH meets security strength');
          }
        }