From 9d26b8c05f5308b474b560fa2a8a1046e2f5c1b6 Mon Sep 17 00:00:00 2001 From: Phil Pennock Date: Mon, 21 May 2012 00:20:37 -0400 Subject: features.h; tls_validate_require_cipher: log flag & tests Pull in on Linux. Switch readconf log from D_all (bug) to D_tls (though D_any would have worked). Modified runtest to handle clamped DH bits and tls_validate_require_cipher added debug logging. --- test/runtest | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'test') diff --git a/test/runtest b/test/runtest index 5ac52ae56..3e961ca98 100755 --- a/test/runtest +++ b/test/runtest @@ -28,9 +28,10 @@ $testversion = "4.80 (08-May-12)"; # This gets embedded in the D-H params filename, and the value comes # from asking GnuTLS for "normal", but there appears to be no way to # use certtool/... to ask what that value currently is. *sigh* -# This value is correct as of GnuTLS 2.12.18. -# -$gnutls_dh_bits_normal = 2432; +# We also clamp it because of NSS interop, see addition of tls_dh_max_bits. +# This value is correct as of GnuTLS 2.12.18 as clamped by tls_dh_max_bits. +# normal = 2432 tls_dh_max_bits = 2236 +$gnutls_dh_bits_normal = 2236; $cf = "bin/cf -exact"; $cr = "\r"; @@ -716,7 +717,6 @@ RESET_AFTER_EXTRA_LINE_READ: s/(TLS error on connection (?:from|to) .*? \(SSL_\w+\): error:)(.*)/$1 <>/; - # ======== Maildir things ======== # timestamp output in maildir processing s/(timestamp=|\(timestamp_only\): )\d+/$1ddddddd/g; @@ -849,6 +849,15 @@ RESET_AFTER_EXTRA_LINE_READ: # be the case next if /^changing group to \d+ failed: Operation not permitted/; + # We might not keep this check; rather than change all the tests, just + # ignore it as long as it succeeds; then we only need to change the + # TLS tests where tls_require_ciphers has been set. + if (m{^changed uid/gid: calling tls_validate_require_cipher}) { + my $discard = ; + next; + } + next if /^tls_validate_require_cipher child \d+ ended: status=0x0/; + # We invoke Exim with -D, so we hit this new messag as of Exim 4.73: next if /^macros_trusted overridden to true by whitelisting/; -- cgit v1.2.3