diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2018-10-16 23:54:28 +0100 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2018-10-17 00:09:36 +0100 |
| commit | 5dcadbf4edc474a0e55a3caaa3604ed06b6a3926 (patch) | |
| tree | eb8eb74b6a0a4d6a8688b4c94460f043db907721 /test | |
| parent | 059f2aced50773fa38661a5a30c54260aee4bf55 (diff) | |
Testsuite: force non-TLSv1.3 for (OpenSSL) cert-variable test
This maintains visibility of the cert choice required by the auth-method configuration.
Leave the bogus results from pre-1.1.1 OpenSSL library bug while the fixed version is not in common use.
Diffstat (limited to 'test')
| -rw-r--r-- | test/confs/2102 | 3 | ||||
| -rw-r--r-- | test/scripts/2100-OpenSSL/2102 | 8 | ||||
| -rw-r--r-- | test/src/client.c | 29 |
3 files changed, 34 insertions, 6 deletions
diff --git a/test/confs/2102 b/test/confs/2102 index c9e00479b..99f659fd2 100644 --- a/test/confs/2102 +++ b/test/confs/2102 @@ -33,6 +33,9 @@ tls_verify_hosts = HOSTIPV4 tls_verify_certificates = DRSA/server2.example.com/ca_chain.pem +.ifdef _OPT_OPENSSL_NO_TLSV1_3_X +openssl_options = +no_tlsv1_3 +.endif # ------ ACL ------ begin acl diff --git a/test/scripts/2100-OpenSSL/2102 b/test/scripts/2100-OpenSSL/2102 index 3904c5098..3465235b0 100644 --- a/test/scripts/2100-OpenSSL/2102 +++ b/test/scripts/2100-OpenSSL/2102 @@ -1,8 +1,10 @@ # TLS server: general ops and certificate extractions # -# NOTE: current OpenSSL libraries return faulty my-cert information -# when more than one is loaded, which the conf for this testcase does. +# NOTE: OpenSSL libraries return faulty my-cert information prior to OpenSSL 1.1.1 +# when more than one cert is loaded, which the conf for this testcase does. # As a result the expansion done and logged is misleading. +# While the golden log output is set to the misleading result, the testcase +# will unfortunately fail on the fixed OpenSSL versions. # # Make RSA authentication the only acceptable exim -DSERVER=server -DORDER=RSA -bd -oX PORT_D @@ -96,6 +98,8 @@ killdaemon # # make ECDSA authentication preferred # DEFAULT:+RSA should work but does not seem to +# also, will fail under TLS1.3 because there is no choice of auth +# - so we disable that in the conf exim -DSERVER=server -DORDER=ECDSA:RSA:!COMPLEMENTOFDEFAULT -bd -oX PORT_D **** client-ssl 127.0.0.1 PORT_D diff --git a/test/src/client.c b/test/src/client.c index 3a6b4ad3d..de36ef065 100644 --- a/test/src/client.c +++ b/test/src/client.c @@ -569,12 +569,31 @@ nextinput: alarm(timeout); if (srv->tls_active) { - #ifdef HAVE_OPENSSL +#ifdef HAVE_OPENSSL + int error; rc = SSL_read(srv->ssl, inbuffer, bsiz - 1); - #endif - #ifdef HAVE_GNUTLS + if (rc <= 0) + switch (error = SSL_get_error(srv->ssl, rc)) + { + case SSL_ERROR_ZERO_RETURN: + break; + case SSL_ERROR_SYSCALL: + printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break; + rc = -1; + case SSL_ERROR_SSL: + printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break; + SSL_shutdown(srv->ssl); + SSL_free(srv->ssl); + srv->tls_active = FALSE; + goto nextinput; + default: + printf("SSL error code %d\n", error); + } + +#endif +#ifdef HAVE_GNUTLS rc = gnutls_record_recv(tls_session, CS inbuffer, bsiz - 1); - #endif +#endif } else rc = read(srv->sock, inbuffer, bsiz); @@ -591,6 +610,8 @@ nextinput: printf("Expected EOF read\n"); continue; } + else if (resp_optional) + continue; /* next scriptline */ else { printf("Unexpected EOF read\n"); |