OpenSSL: Fix tls_eccurve on earlier versions than 3.0.0. Bug 2954

[exim.git] / test / scripts / 2100-OpenSSL / 2149

diff --git a/test/scripts/2100-OpenSSL/2149 b/test/scripts/2100-OpenSSL/2149
index bba05915864f5ded5668bb84f34ee33a53e5afdb..f1af49907e1ec529f93cd0cc5f93ac41b025bfac 100644 (file)
--- a/test/scripts/2100-OpenSSL/2149
+++ b/test/scripts/2100-OpenSSL/2149
@@ -1,11 +1,54 @@
-# TLS: DH ciphers for OpenSSL
+# TLS: EC curves for OpenSSL
+#
+# This is only checking the acceptability of option settings, not their effect
+# See packet captures for actual effects
+#
+# Baseline: tls_eccurve option not present
 exim -DSERVER=server -bd -oX PORT_D
 ****
-exim userx@test.ex
-Test message
+exim -odf optnotpresent@test.ex
 ****
-exim -qf
+killdaemon
+#
+# Explicit tls_eccurve setting of "auto"
+exim -DSERVER=server -DDATA=auto -bd -oX PORT_D
+****
+exim -odf explicitauto@test.ex
 ****
 killdaemon
-exim -DSERVER=server -DNOTDAEMON -qf
+#
+# Explicit tls_eccurve setting of ""
+# - unclear this works.  At least with OpenSSL 3.0.5 we still get an x25519 keyshare in the Server Hello
+exim -DSERVER=server -DDATA= -bd -oX PORT_D
 ****
+exim -odf explicitempty@test.ex
+****
+killdaemon
+#
+# prime256v1
+# Oddly,  3.0.5 packets show an EC-groups negotiation of C:x255519 S:secp256r1 C:secp384r1 S:secp384r1.
+# Hoever, note that RFC 8446 (TLS1.3) does NOT include prime256v1 as one of the allowable
+# supported groups (and it's not in the client "supported groups" extension, so what we see seems good.
+exim -DSERVER=server -DDATA=prime256v1 -bd -oX PORT_D
+****
+exim -odf prime256v1@test.ex
+****
+killdaemon
+#
+# secp384r1
+# C:x25519 S:secp384r1
+exim -DSERVER=server -DDATA=secp384r1 -bd -oX PORT_D
+****
+exim -odf secp384r1@test.ex
+****
+killdaemon
+#
+# "bogus".  Should fail to make connection.
+exim -DSERVER=server -DDATA=bogus -bd -oX PORT_D
+****
+exim -odf user_fail@test.ex
+****
+killdaemon
+#
+#
+no_message_check