Gitweb:
http://git.exim.org/exim.git/commitdiff/281e72e46c44d316d47ed309dcb0d781a909a181
Commit: 281e72e46c44d316d47ed309dcb0d781a909a181
Parent: 25df7d07925b61e29d471d8d993c37f758a08cf2
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Wed Dec 3 21:09:54 2014 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Wed Dec 3 21:09:54 2014 +0000
Testsuite: add more DANE testcases
---
test/confs/5840 | 13 +++++++------
test/log/5840 | 25 ++++++++++++++++++++-----
test/scripts/5840-DANE-OpenSSL/5840 | 31 +++++++++++++++++++++++++------
3 files changed, 52 insertions(+), 17 deletions(-)
diff --git a/test/confs/5840 b/test/confs/5840
index 68a47e9..2c72b64 100644
--- a/test/confs/5840
+++ b/test/confs/5840
@@ -18,7 +18,6 @@ acl_smtp_rcpt = accept
log_selector = +received_recipients +tls_peerdn +tls_certificate_verified
-queue_only
queue_run_in_order
tls_advertise_hosts = *
@@ -28,18 +27,17 @@ CDIR1 = DIR/aux-fixed
CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com
tls_certificate = ${if eq {SERVER}{server} \
- {${if eq {DETAILS}{ta} \
+ {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}}} \
{CDIR2/fullchain.pem}\
{CDIR1/cert1}}}\
fail}
tls_privatekey = ${if eq {SERVER}{server} \
- {${if eq {DETAILS}{ta} \
+ {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}}} \
{CDIR2/server1.example.com.unlocked.key}\
{CDIR1/cert1}}}\
fail}
-
# ----- Routers -----
begin routers
@@ -65,11 +63,14 @@ send_to_server:
allow_localhost
port = PORT_D
-# hosts_try_dane = *
- hosts_require_dane = *
+ hosts_try_dane = *
+ hosts_require_dane = !thishost.test.ex
hosts_request_ocsp = ${if or { {= {4}{$tls_out_tlsa_usage}} \
{= {0}{$tls_out_tlsa_usage}} } \
{*}{}}
+ tls_try_verify_hosts = thishost.test.ex
+ tls_verify_certificates = CDIR2/ca_chain.pem
+
# ----- Retry -----
diff --git a/test/log/5840 b/test/log/5840
index 62dc13f..7507c5c 100644
--- a/test/log/5840
+++ b/test/log/5840
@@ -11,20 +11,35 @@
1999-03-02 09:44:33 10HmbB-0005vi-00 => CALLER@??? R=client T=send_to_server H=dane256ta.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=dane DN="/CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@??? U=CALLER P=local S=sss for CALLER@???
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbD-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmbD-0005vi-00 => CALLER@??? R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbE-0005vi-00"
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@??? U=CALLER P=local S=sss for CALLER@???
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmbF-0005vi-00 => CALLER@??? R=client T=send_to_server H=thishost.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbG-0005vi-00"
+1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
******** SERVER ********
1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@??? H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@??? for CALLER@???
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@??? H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@??? for CALLER@???
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <CALLER@???> R=server
1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@??? H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@??? for CALLER@???
1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@???> R=server
1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@??? H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbB-0005vi-00@??? for CALLER@???
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@???> R=server
1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@??? H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbD-0005vi-00@??? for CALLER@???
+1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <CALLER@???> R=server
+1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@??? H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbF-0005vi-00@??? for CALLER@???
+1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <CALLER@???> R=server
+1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
diff --git a/test/scripts/5840-DANE-OpenSSL/5840 b/test/scripts/5840-DANE-OpenSSL/5840
index 814b4b0..eef14c2 100644
--- a/test/scripts/5840-DANE-OpenSSL/5840
+++ b/test/scripts/5840-DANE-OpenSSL/5840
@@ -3,28 +3,47 @@
exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
****
# TLSA (3 1 1)
-exim CALLER@???
+exim -odq CALLER@???
Testing
****
# TLSA (3 1 2)
-exim CALLER@???
+exim -odq CALLER@???
Testing
****
exim -qf
****
killdaemon
-exim -DSERVER=server -DDETAILS=ee -DNOTDAEMON -qf
-****
#
#
exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
****
# TLSA (2 0 1)
-exim CALLER@???
+exim -odq CALLER@???
Testing
****
exim -qf
****
killdaemon
-exim -DSERVER=server -DDETAILS=ta -DNOTDAEMON -qf
+#
+# A server with a nonverifying cert and no TLSA
+# Check we get a non-CV but TLS connection, with try_dane but no require_dane
+exim -DSERVER=server -DDETAILS=no -bd -oX PORT_D
+****
+exim -odq CALLER@???
+Testing
****
+exim -qf
+****
+killdaemon
+#
+# A server with a verifying cert and no TLSA
+# Check we get a CV and TLS connection, with try_dane but no require_dane
+exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
+****
+exim -odq CALLER@???
+Testing
+****
+exim -qf
+****
+killdaemon
+#
