Gitweb:
https://git.exim.org/exim.git/commitdiff/5dcadbf4edc474a0e55a3caaa3604ed06b6a3926
Commit: 5dcadbf4edc474a0e55a3caaa3604ed06b6a3926
Parent: 059f2aced50773fa38661a5a30c54260aee4bf55
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Tue Oct 16 23:54:28 2018 +0100
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Wed Oct 17 00:09:36 2018 +0100
Testsuite: force non-TLSv1.3 for (OpenSSL) cert-variable test
This maintains visibility of the cert choice required by the auth-method configuration.
Leave the bogus results from pre-1.1.1 OpenSSL library bug while the fixed version is not in common use.
---
test/confs/2102 | 3 +++
test/scripts/2100-OpenSSL/2102 | 8 ++++++--
test/src/client.c | 29 +++++++++++++++++++++++++----
3 files changed, 34 insertions(+), 6 deletions(-)
diff --git a/test/confs/2102 b/test/confs/2102
index c9e0047..99f659f 100644
--- a/test/confs/2102
+++ b/test/confs/2102
@@ -33,6 +33,9 @@ tls_verify_hosts = HOSTIPV4
tls_verify_certificates = DRSA/server2.example.com/ca_chain.pem
+.ifdef _OPT_OPENSSL_NO_TLSV1_3_X
+openssl_options = +no_tlsv1_3
+.endif
# ------ ACL ------
begin acl
diff --git a/test/scripts/2100-OpenSSL/2102 b/test/scripts/2100-OpenSSL/2102
index 3904c50..3465235 100644
--- a/test/scripts/2100-OpenSSL/2102
+++ b/test/scripts/2100-OpenSSL/2102
@@ -1,8 +1,10 @@
# TLS server: general ops and certificate extractions
#
-# NOTE: current OpenSSL libraries return faulty my-cert information
-# when more than one is loaded, which the conf for this testcase does.
+# NOTE: OpenSSL libraries return faulty my-cert information prior to OpenSSL 1.1.1
+# when more than one cert is loaded, which the conf for this testcase does.
# As a result the expansion done and logged is misleading.
+# While the golden log output is set to the misleading result, the testcase
+# will unfortunately fail on the fixed OpenSSL versions.
#
# Make RSA authentication the only acceptable
exim -DSERVER=server -DORDER=RSA -bd -oX PORT_D
@@ -96,6 +98,8 @@ killdaemon
#
# make ECDSA authentication preferred
# DEFAULT:+RSA should work but does not seem to
+# also, will fail under TLS1.3 because there is no choice of auth
+# - so we disable that in the conf
exim -DSERVER=server -DORDER=ECDSA:RSA:!COMPLEMENTOFDEFAULT -bd -oX PORT_D
****
client-ssl 127.0.0.1 PORT_D
diff --git a/test/src/client.c b/test/src/client.c
index 3a6b4ad..de36ef0 100644
--- a/test/src/client.c
+++ b/test/src/client.c
@@ -569,12 +569,31 @@ nextinput:
alarm(timeout);
if (srv->tls_active)
{
- #ifdef HAVE_OPENSSL
+#ifdef HAVE_OPENSSL
+ int error;
rc = SSL_read(srv->ssl, inbuffer, bsiz - 1);
- #endif
- #ifdef HAVE_GNUTLS
+ if (rc <= 0)
+ switch (error = SSL_get_error(srv->ssl, rc))
+ {
+ case SSL_ERROR_ZERO_RETURN:
+ break;
+ case SSL_ERROR_SYSCALL:
+ printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break;
+ rc = -1;
+ case SSL_ERROR_SSL:
+ printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break;
+ SSL_shutdown(srv->ssl);
+ SSL_free(srv->ssl);
+ srv->tls_active = FALSE;
+ goto nextinput;
+ default:
+ printf("SSL error code %d\n", error);
+ }
+
+#endif
+#ifdef HAVE_GNUTLS
rc = gnutls_record_recv(tls_session, CS inbuffer, bsiz - 1);
- #endif
+#endif
}
else
rc = read(srv->sock, inbuffer, bsiz);
@@ -591,6 +610,8 @@ nextinput:
printf("Expected EOF read\n");
continue;
}
+ else if (resp_optional)
+ continue; /* next scriptline */
else
{
printf("Unexpected EOF read\n");
