GnuTLS: clear errno before any data i/o op, so error logging does not see stale values

[exim.git] / test / stdout / 2114

diff --git a/test/stdout/2114 b/test/stdout/2114
index 5f07ba489f183817b10888cfc00fb67c77f4d7bf..e4b3b5a9103e008906f080a65d1a577ac9e04bc4 100644 (file)
--- a/test/stdout/2114
+++ b/test/stdout/2114
@@ -1,3 +1,4 @@
+### No certificate, certificate required

 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000


@@ -18,23 +19,20 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read server session ticket A
-pppp:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
+pppp:error:dddddddd:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:[...]:SSL alert number 40

 Failed to start TLS
 Failed to start TLS

+>>> noop
+????554 Security failure
+>>> noop
+??? 554 Security failure
+<<< 554 Security failure
+>>> quit
+????554 Security failure
+????221
+???*
+Expected EOF read

 End of script
 End of script

+### No certificate, certificate optional at TLS time, required by ACL

 Connecting to 127.0.0.1 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 Connecting to 127.0.0.1 port 1225 ... connected
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000


@@ -55,23 +53,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read finished A
-SSL info: SSL negotiation finished successfully
-SSL info: SSL negotiation finished successfully
-SSL connection using AES256-SHA

 Succeeded in starting TLS
 >>> helo rhu.barb
 ??? 250
 Succeeded in starting TLS
 >>> helo rhu.barb
 ??? 250


@@ -86,9 +67,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script

+### Good certificate, certificate required

 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected

-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -108,24 +90,6 @@ Key file = aux-fixed/cert2
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read finished A
-SSL info: SSL negotiation finished successfully
-SSL info: SSL negotiation finished successfully
-SSL connection using AES256-SHA

 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250


@@ -137,9 +101,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script

+### Good certificate, certificate optional at TLS time, checked by ACL

 Connecting to 127.0.0.1 port 1225 ... connected
 Connecting to 127.0.0.1 port 1225 ... connected

-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -159,24 +124,6 @@ Key file = aux-fixed/cert2
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read finished A
-SSL info: SSL negotiation finished successfully
-SSL info: SSL negotiation finished successfully
-SSL connection using AES256-SHA

 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250


@@ -188,9 +135,10 @@ Succeeded in starting TLS
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script

+### Bad certificate, certificate required

 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected

-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -210,27 +158,18 @@ Key file = aux-fixed/cert1
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read server session ticket A
-pppp:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:dddd:SSL alert number 48
+pppp:error:dddddddd:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:[...]:SSL alert number 48

 Failed to start TLS
 Failed to start TLS

+>>> noop
+????554 Security failure
+>>> noop
+??? 554 Security failure
+<<< 554 Security failure

 End of script
 End of script

+### Bad certificate, certificate optional at TLS time, reject at ACL time

 Connecting to 127.0.0.1 port 1225 ... connected
 Connecting to 127.0.0.1 port 1225 ... connected

-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+Key file = aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -250,40 +189,21 @@ Key file = aux-fixed/cert1
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read finished A
-SSL info: SSL negotiation finished successfully
-SSL info: SSL negotiation finished successfully
-SSL connection using AES256-SHA

 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>

-??? 550-
-<<< 550-certificate not verified: peerdn=/C=UK/L=Cambridge/O=University of

 ??? 550
 ??? 550

-<<< 550 Cambridge/OU=Computing Service/CN=Philip Hazel
+<<< 550 certificate not verified: peerdn=/CN=server1.example.net

 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script

+### Otherwise good but revoked certificate, certificate required

 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected

-Certificate file = aux-fixed/cert2
-Key file = aux-fixed/cert2
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -303,27 +223,18 @@ Key file = aux-fixed/cert2
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read server session ticket A
-pppp:error:14094414:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate revoked:s3_pkt.c:dddd:SSL alert number 44
+pppp:error:dddddddd:SSL routines:ssl3_read_bytes:sslv3 alert certificate revoked:[...]:SSL alert number 44

 Failed to start TLS
 Failed to start TLS

+>>> noop
+????554 Security failure
+>>> noop
+??? 554 Security failure
+<<< 554 Security failure

 End of script
 End of script

+### Revoked certificate, certificate optional at TLS time, reject at ACL time

 Connecting to 127.0.0.1 port 1225 ... connected
 Connecting to 127.0.0.1 port 1225 ... connected

-Certificate file = aux-fixed/cert1
-Key file = aux-fixed/cert1
+Certificate file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key

 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb
 ??? 220
 <<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo rhu.barb


@@ -343,34 +254,59 @@ Key file = aux-fixed/cert1
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-SSL info: before/connect initialization
-SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
-SSL info: SSLv3 read server hello A
-SSL info: SSLv3 read server certificate A
-SSL info: SSLv3 read server certificate request A
-SSL info: SSLv3 read server done A
-SSL info: SSLv3 write client certificate A
-SSL info: SSLv3 write client key exchange A
-SSL info: SSLv3 write certificate verify A
-SSL info: SSLv3 write change cipher spec A
-SSL info: SSLv3 write finished A
-SSL info: SSLv3 flush data
-SSL info: SSLv3 read server session ticket A
-SSL info: SSLv3 read finished A
-SSL info: SSL negotiation finished successfully
-SSL info: SSL negotiation finished successfully
-SSL connection using AES256-SHA

 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>
 Succeeded in starting TLS
 >>> mail from:<userx@test.ex>
 ??? 250
 <<< 250 OK
 >>> rcpt to:<userx@test.ex>

-??? 550-
-<<< 550-certificate not verified: peerdn=/C=UK/L=Cambridge/O=University of

 ??? 550
 ??? 550

-<<< 550 Cambridge/OU=Computing Service/CN=Philip Hazel
+<<< 550 certificate not verified: peerdn=/CN=revoked1.example.com
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
+### Good certificate, certificate required - but nonmatching CRL also present
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+Key file = aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+Succeeded in starting TLS
+>>> mail from:<userx@test.ex>
+??? 250
+<<< 250 OK
+>>> rcpt to:<userx@test.ex>
+??? 250
+<<< 250 Accepted

 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
 End of script

+
+******** SERVER ********
+### No certificate, certificate required
+### No certificate, certificate optional at TLS time, required by ACL
+### Good certificate, certificate required
+### Good certificate, certificate optional at TLS time, checked by ACL
+### Bad certificate, certificate required
+### Bad certificate, certificate optional at TLS time, reject at ACL time
+### Otherwise good but revoked certificate, certificate required
+### Revoked certificate, certificate optional at TLS time, reject at ACL time
+### Good certificate, certificate required - but nonmatching CRL also present