X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/131c0f8aad2e08201a3977401f15dfd2b5127b69..32281b98f0a9e86de91d7ed56fb62a49edffcd8d:/test/scripts/2100-OpenSSL/2102?ds=inline diff --git a/test/scripts/2100-OpenSSL/2102 b/test/scripts/2100-OpenSSL/2102 index bdf5496f6..baebe5eb1 100644 --- a/test/scripts/2100-OpenSSL/2102 +++ b/test/scripts/2100-OpenSSL/2102 @@ -1,5 +1,15 @@ # TLS server: general ops and certificate extractions -exim -DSERVER=server -bd -oX PORT_D +# +# NOTE: OpenSSL libraries return faulty my-cert information prior to OpenSSL 1.1.1 +# when more than one cert is loaded, which the conf for this testcase does. +# As a result the expansion done and logged is misleading. +# While the golden log output is set to the misleading result, the testcase +# would unfortunately fail on the fixed OpenSSL versions. This has been bodged +# by the addition of log/2102.openssl_1_1_1 and some detection coding in +# runtest to force a "flavour". This is fragile and bound to break in the future. +# +# Make RSA authentication the only acceptable +exim -DSERVER=server -DORDER=RSA -bd -oX PORT_D **** client-ssl 127.0.0.1 PORT_D ??? 220 @@ -9,10 +19,18 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 -mail from: +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +mail from: ??? 250 rcpt to: ??? 250 @@ -32,9 +50,17 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 mail from:<"name with spaces"@test.ex> ??? 250 rcpt to: @@ -56,6 +82,7 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 TLS go ahead @@ -71,10 +98,18 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 -mail from: +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +mail from: ??? 250 rcpt to: ??? 250 @@ -87,6 +122,46 @@ quit ??? 221 **** killdaemon +# +# make ECDSA authentication preferred +# DEFAULT:+RSA should work but does not seem to +# also, will fail under TLS1.3 because there is no choice of auth +# - so we disable that in the conf +exim -DSERVER=server -DORDER=ECDSA:RSA:!COMPLEMENTOFDEFAULT -bd -oX PORT_D +**** +client-ssl 127.0.0.1 PORT_D +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +starttls +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +mail from: +??? 250 +rcpt to: +??? 250 +DATA +??? 3 +This is a test encrypted message. +It should be sent under the EC server cert and with an ECDSA cipher. +. +??? 250 +quit +??? 221 +**** +killdaemon exim -qf **** exim -bh 10.0.0.1