X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/9d1c15ef45fcc8809349378922de20ae9a774c75..b217e871882835c14d7bda8e35c0d7e888a40349:/test/scripts/2000-GnuTLS/2002?ds=sidebyside diff --git a/test/scripts/2000-GnuTLS/2002 b/test/scripts/2000-GnuTLS/2002 index 49f841e56..cdaf56d68 100644 --- a/test/scripts/2000-GnuTLS/2002 +++ b/test/scripts/2000-GnuTLS/2002 @@ -1,8 +1,19 @@ # TLS server: general ops and certificate extractions gnutls +# +# Very early (unsure when) GnuTLS prefers RSA auth by default. Later, but before 3.6.x, prefers +# ECDSA but the client can be given a priority order to override that. We're running the server +# with no priority string given (tls_require_ciphers) hence default, and with both types of +# server cert loaded (RSA first, though we don't document that as relevant and in testing it +# does not appear to matter). +# +# GnuTLS 3.6.5 appears to ignore the client priority ordering, always choosing ECDSA if both +# are permitted, if TLS1.3 is permitted, so we limit to TLS1.2. +# exim -DSERVER=server -bd -oX PORT_D **** -client-gnutls 127.0.0.1 PORT_D +# Have the client do RSA (but support ECDSA as well). That should get us RSA on both older and newer GnuTLS. +client-gnutls -p NONE:+SIGN-RSA-SHA256:+SIGN-ECDSA-SHA512:+VERS-TLS1.2:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 127.0.0.1 PORT_D ??? 220 ehlo rhu.barb ??? 250- @@ -10,9 +21,17 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 mail from: ??? 250 rcpt to: @@ -25,7 +44,7 @@ This is a test encrypted message. quit ??? 221 **** -client-gnutls 127.0.0.1 PORT_D +client-gnutls -p NONE:+SIGN-RSA-SHA256:+SIGN-ECDSA-SHA512:+VERS-TLS1.2:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 127.0.0.1 PORT_D ??? 220 ehlo rhu.barb ??? 250- @@ -33,9 +52,12 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 +helo test +??? 250 mail from:<"name with spaces"@test.ex> ??? 250 rcpt to: @@ -48,7 +70,32 @@ This is a test encrypted message. quit ??? 221 **** -client-gnutls HOSTIPV4 PORT_D +# +# Server asks for a client cert but client does not supply one +client-gnutls -p NONE:+SIGN-RSA-SHA256:+SIGN-ECDSA-SHA512:+VERS-TLS1.2:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 HOSTIPV4 PORT_D +??? 220 +ehlo rhu.barb +??? 250- +??? 250-SIZE +??? 250-LIMITS +??? 250-8BITMIME +??? 250-PIPELINING +??? 250-STARTTLS +??? 250 HELP +starttls +??? 220 TLS go ahead +nop +???* +**** +# ensure sequence of log TLS error line +killdaemon +sleep 1 +exim -DSERVER=server -bd -oX PORT_D +**** +# +# +# Server asks for a client cert, and one is given which is verifiable by the server +client-gnutls -p NONE:+SIGN-RSA-SHA256:+SIGN-ECDSA-SHA512:+VERS-TLS1.2:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 HOSTIPV4 PORT_D DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key ??? 220 ehlo rhu.barb ??? 250- @@ -56,11 +103,32 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 +helo test +??? 250 +mail from: +??? 250 +rcpt to: +??? 250 +DATA +??? 3 +This is a test encrypted message from a verified host. +. +??? 250 +quit +??? 221 **** -client-gnutls HOSTIPV4 PORT_D DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key +# +# +# A client that only talks RSA. +# +# We have to specify the key-exchange as well as the authentication, otherwise, +# the GnuTLS server side being foolish - it picks an ECDSA cipher-suite and then can't use it :( +# Possibly fixed in 3.6.x ? +client-gnutls -p NONE:+SIGN-RSA-SHA256:+VERS-TLS1.2:+ECDHE-RSA:+DHE-RSA:+RSA:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 127.0.0.1 PORT_D ??? 220 ehlo rhu.barb ??? 250- @@ -68,24 +136,63 @@ ehlo rhu.barb ??? 250- ??? 250- ??? 250- +??? 250- ??? 250 starttls ??? 220 +helo test +??? 250 mail from: ??? 250 rcpt to: ??? 250 DATA ??? 3 -This is a test encrypted message from a verified host. +This is a test encrypted message. +It should be sent under the RSA server cert and with an RSA cipher. +. +??? 250 +quit +??? 221 +**** +# +# +# Make ECDSA authentication preferred (Older GnuTLS prefers RSA, it seems, Newer, ECDSA). +client-gnutls -p NONE:+SIGN-ECDSA-SHA512:+VERS-TLS1.2:+KX-ALL:+CIPHER-ALL:+MAC-ALL:+COMP-NULL:+CURVE-ALL:+CTYPE-X509 127.0.0.1 PORT_D +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +starttls +??? 220 +helo test +??? 250 +mail from: +??? 250 +rcpt to: +??? 250 +DATA +??? 3 +This is a test encrypted message. +It should be sent under the EC server cert and with an ECDSA cipher. . ??? 250 quit ??? 221 **** killdaemon +sleep 1 +# clear out the queue exim -qf **** +sleep 1 +# +# STARTTLS used when not advertised exim -bh 10.0.0.1 starttls quit