Restore testsuite operation on earlier GnuTLS libraries

diff --git a/test/confs/5750 b/test/confs/5750
index a4762bd1963d4af0a408087753e4099230b7d4ea..daff91bb3560472b4668246220baeec55d43cca0 100644 (file)
--- a/test/confs/5750
+++ b/test/confs/5750
@@ -48,7 +48,7 @@ logger:
          logwrite =  SA  <${certextract {signature_algorithm}{$tls_out_peercert}}>
          logwrite =  SG  <${certextract {signature}    {$tls_out_peercert}}>
         logwrite =       ${certextract {subject_altname}{$tls_out_peercert}{SAN <$value>}{(no SAN)}}
          logwrite =  SA  <${certextract {signature_algorithm}{$tls_out_peercert}}>
          logwrite =  SG  <${certextract {signature}    {$tls_out_peercert}}>
         logwrite =       ${certextract {subject_altname}{$tls_out_peercert}{SAN <$value>}{(no SAN)}}

-        logwrite =       ${certextract {ocsp_uri}      {$tls_out_peercert} {OCU <$value>}{(no OCU)}}
+#       logwrite =       ${certextract {ocsp_uri}      {$tls_out_peercert} {OCU <$value>}{(no OCU)}}

         logwrite =       ${certextract {crl_uri}       {$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
 
         logwrite =       ${certextract {crl_uri}       {$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
 

diff --git a/test/log/2002 b/test/log/2002
index e2777b459a6de8f9bd9efd6aa72dd67ae4f906c1..50b7863d216dd404982b512cde4d0435930850a3 100644 (file)
--- a/test/log/2002
+++ b/test/log/2002
@@ -14,7 +14,7 @@
 1999-03-02 09:44:33 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 NB  <Nov  1 12:34:06 2012 GMT>
 1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 GMT>
 1999-03-02 09:44:33 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 NB  <Nov  1 12:34:06 2012 GMT>
 1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 GMT>

-1999-03-02 09:44:33 SA  <RSA-SHA1>
+1999-03-02 09:44:33 SA  <RSA-SHA>

 1999-03-02 09:44:33 SG  <6c 37 41 26 4d 5d f4 b5 31 10 67 ca fb 64 b6 22 98 62 f7 1e 95 7b 6c e6 74 47 21 f4 5e 89 36 3e b9 9c 8a c5 52 bb c4 af 12 93 26 3b d7 3d e0 56 71 1e 1d 21 20 02 ed f0 4e d5 5e 45 42 fd 3c 38 41 54 83 86 0b 3b bf c5 47 39 ff 15 ea 93 dc fd c7 3d 18 58 59 ca dd 2a d8 b9 f9 2f b9 76 93 f4 ae e3 91 56 80 2f 8c 04 2f ad 57 ef d2 51 19 f4 b4 ef 32 9c ac 3a 7c 0d b8 39 db b1 e3 30 73 1a>
 1999-03-02 09:44:33 SAN <server2.example.com>
 1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 SG  <6c 37 41 26 4d 5d f4 b5 31 10 67 ca fb 64 b6 22 98 62 f7 1e 95 7b 6c e6 74 47 21 f4 5e 89 36 3e b9 9c 8a c5 52 bb c4 af 12 93 26 3b d7 3d e0 56 71 1e 1d 21 20 02 ed f0 4e d5 5e 45 42 fd 3c 38 41 54 83 86 0b 3b bf c5 47 39 ff 15 ea 93 dc fd c7 3d 18 58 59 ca dd 2a d8 b9 f9 2f b9 76 93 f4 ae e3 91 56 80 2f 8c 04 2f ad 57 ef d2 51 19 f4 b4 ef 32 9c ac 3a 7c 0d b8 39 db b1 e3 30 73 1a>
 1999-03-02 09:44:33 SAN <server2.example.com>
 1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>

diff --git a/test/log/5750 b/test/log/5750
index 8c98b5b9561c0d3e94f548a0b4ac43643c336771..c3c77a6420e3ef7f863b2af743882f348df645ec 100644 (file)
--- a/test/log/5750
+++ b/test/log/5750
@@ -10,10 +10,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:05 2012 GMT>
 1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:05 2038 GMT>
 1999-03-02 09:44:33 10HmaX-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:05 2012 GMT>
 1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:05 2038 GMT>

-1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <RSA-SHA1>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <RSA-SHA>

 1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <56 3a a4 3c cb eb b8 27 c2 90 08 74 13 88 dc 48 c6 b5 2c e5 26 be 5b 91 d4 67 e7 3c 49 12 d7 47 30 df 98 db 58 ed 18 a8 7d 4b db 97 48 f5 5c 7f 70 b9 37 63 33 f1 24 62 72 92 60 f5 6e da b6 bc 73 c8 c2 dc d6 95 9a bd 16 16 a2 ef 0a f1 d7 41 68 f6 ad 98 5a d0 ff d9 1b 51 9f 59 ce 2f 3d 84 d0 ee e8 2b eb 9b 32 1a 0e 02 3e cc 30 89 44 09 2a 75 81 46 a7 b6 ed 7d 41 eb 5a 63 fa 9c 58 ef>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <alternatename.server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <56 3a a4 3c cb eb b8 27 c2 90 08 74 13 88 dc 48 c6 b5 2c e5 26 be 5b 91 d4 67 e7 3c 49 12 d7 47 30 df 98 db 58 ed 18 a8 7d 4b db 97 48 f5 5c 7f 70 b9 37 63 33 f1 24 62 72 92 60 f5 6e da b6 bc 73 c8 c2 dc d6 95 9a bd 16 16 a2 ef 0a f1 d7 41 68 f6 ad 98 5a d0 ff d9 1b 51 9f 59 ce 2f 3d 84 d0 ee e8 2b eb 9b 32 1a 0e 02 3e cc 30 89 44 09 2a 75 81 46 a7 b6 ed 7d 41 eb 5a 63 fa 9c 58 ef>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <alternatename.server1.example.com>

-1999-03-02 09:44:33 10HmaX-0005vi-00 OCU <http://oscp/example.com/>

 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"


@@ -30,10 +29,9 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:05 2012 GMT>
 1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:05 2038 GMT>
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:05 2012 GMT>
 1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:05 2038 GMT>

-1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <RSA-SHA1>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <RSA-SHA>

 1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <56 3a a4 3c cb eb b8 27 c2 90 08 74 13 88 dc 48 c6 b5 2c e5 26 be 5b 91 d4 67 e7 3c 49 12 d7 47 30 df 98 db 58 ed 18 a8 7d 4b db 97 48 f5 5c 7f 70 b9 37 63 33 f1 24 62 72 92 60 f5 6e da b6 bc 73 c8 c2 dc d6 95 9a bd 16 16 a2 ef 0a f1 d7 41 68 f6 ad 98 5a d0 ff d9 1b 51 9f 59 ce 2f 3d 84 d0 ee e8 2b eb 9b 32 1a 0e 02 3e cc 30 89 44 09 2a 75 81 46 a7 b6 ed 7d 41 eb 5a 63 fa 9c 58 ef>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <alternatename.server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <56 3a a4 3c cb eb b8 27 c2 90 08 74 13 88 dc 48 c6 b5 2c e5 26 be 5b 91 d4 67 e7 3c 49 12 d7 47 30 df 98 db 58 ed 18 a8 7d 4b db 97 48 f5 5c 7f 70 b9 37 63 33 f1 24 62 72 92 60 f5 6e da b6 bc 73 c8 c2 dc d6 95 9a bd 16 16 a2 ef 0a f1 d7 41 68 f6 ad 98 5a d0 ff d9 1b 51 9f 59 ce 2f 3d 84 d0 ee e8 2b eb 9b 32 1a 0e 02 3e cc 30 89 44 09 2a 75 81 46 a7 b6 ed 7d 41 eb 5a 63 fa 9c 58 ef>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <alternatename.server1.example.com>

-1999-03-02 09:44:33 10HmaY-0005vi-00 OCU <http://oscp/example.com/>

 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/runtest b/test/runtest
index c6a365f255623e90a1ae436f408f8e5b48262c2d..458c9a65916e72df1b51ab29f2e96145ea2bc787 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -543,6 +543,9 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/TLS error on connection to \d{1,3}(.\d{1,3}){3} \[\d{1,3}(.\d{1,3}){3}\] \(gnutls_handshake\): A TLS packet with unexpected length was received./a TLS session is required for ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4], but an attempt to start TLS failed/g;
   s/TLS error on connection from \[127.0.0.1\] \(recv\): A TLS packet with unexpected length was received./TLS error on connection from [127.0.0.1] (recv): The TLS connection was non-properly terminated./g;
 
   s/TLS error on connection to \d{1,3}(.\d{1,3}){3} \[\d{1,3}(.\d{1,3}){3}\] \(gnutls_handshake\): A TLS packet with unexpected length was received./a TLS session is required for ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4], but an attempt to start TLS failed/g;
   s/TLS error on connection from \[127.0.0.1\] \(recv\): A TLS packet with unexpected length was received./TLS error on connection from [127.0.0.1] (recv): The TLS connection was non-properly terminated./g;
 

+  # signature algorithm names
+  s/RSA-SHA1/RSA_SHA/;
+

 
   # ======== Caller's login, uid, gid, home, gecos ========
 
 
   # ======== Caller's login, uid, gid, home, gecos ========
 

diff --git a/test/src/client.c b/test/src/client.c
index be6bffbac6c83139edabb5fdef0849e8d63004a3..e7210f22398ac15252efbde89b3d85078f0a6eec 100644 (file)
--- a/test/src/client.c
+++ b/test/src/client.c
@@ -60,24 +60,27 @@ static int sigalrm_seen = 0;
 latter needs a whole pile of tables. */
 
 #ifdef HAVE_OPENSSL
 latter needs a whole pile of tables. */
 
 #ifdef HAVE_OPENSSL

-#define HAVE_TLS
-#include <openssl/crypto.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-#include <openssl/rand.h>
-#include <openssl/ocsp.h>
+# define HAVE_TLS
+# include <openssl/crypto.h>
+# include <openssl/x509.h>
+# include <openssl/pem.h>
+# include <openssl/ssl.h>
+# include <openssl/err.h>
+# include <openssl/rand.h>
+# include <openssl/ocsp.h>

 #endif
 
 
 #ifdef HAVE_GNUTLS
 #endif
 
 
 #ifdef HAVE_GNUTLS

-#define HAVE_TLS
-#include <gnutls/gnutls.h>
-#include <gnutls/x509.h>
-#include <gnutls/ocsp.h>
+# define HAVE_TLS
+# include <gnutls/gnutls.h>
+# include <gnutls/x509.h>
+# if GNUTLS_VERSION_NUMBER >= 0x030103
+#  define HAVE_OCSP
+#  include <gnutls/ocsp.h>
+# endif

 
 

-#define DH_BITS      768
+# define DH_BITS      768

 
 /* Local static variables for GNUTLS */
 
 
 /* Local static variables for GNUTLS */
 


@@ -113,7 +116,7 @@ static const int mac_priority[16] = {
 static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
 static const int cert_type_priority[16] = { GNUTLS_CRT_X509, 0 };
 
 static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
 static const int cert_type_priority[16] = { GNUTLS_CRT_X509, 0 };
 

-#endif
+#endif /*HAVE_GNUTLS*/

 
 
 
 
 
 


@@ -767,8 +770,10 @@ if (certfile != NULL) printf("Certificate file = %s\n", certfile);
 if (keyfile != NULL) printf("Key file = %s\n", keyfile);
 tls_init(certfile, keyfile);
 tls_session = tls_session_init();
 if (keyfile != NULL) printf("Key file = %s\n", keyfile);
 tls_init(certfile, keyfile);
 tls_session = tls_session_init();

+#ifdef HAVE_OCSP

 if (ocsp_stapling)
   gnutls_ocsp_status_request_enable_client(tls_session, NULL, 0, NULL);
 if (ocsp_stapling)
   gnutls_ocsp_status_request_enable_client(tls_session, NULL, 0, NULL);

+#endif

 gnutls_transport_set_ptr(tls_session, (gnutls_transport_ptr)sock);
 
 /* When the server asks for a certificate and the client does not have one,
 gnutls_transport_set_ptr(tls_session, (gnutls_transport_ptr)sock);
 
 /* When the server asks for a certificate and the client does not have one,


@@ -803,7 +808,7 @@ if (tls_on_connect)
 
   if (!tls_active)
     printf("Failed to start TLS\n");
 
   if (!tls_active)
     printf("Failed to start TLS\n");

-  #ifdef HAVE_GNUTLS
+  #if defined(HAVE_GNUTLS) && defined(HAVE_OCSP)

   else if (  ocsp_stapling
          && gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
     printf("Failed to verify certificate status\n");
   else if (  ocsp_stapling
          && gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
     printf("Failed to verify certificate status\n");


@@ -917,6 +922,7 @@ int rc;
            printf("Bad certificate\n");
            fflush(stdout);
            }
            printf("Bad certificate\n");
            fflush(stdout);
            }

+         #ifdef HAVE_OCSP

          else if (gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
            {
            printf("Failed to verify certificate status\n");
          else if (gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
            {
            printf("Failed to verify certificate status\n");


@@ -938,6 +944,7 @@ int rc;
              }
            fflush(stdout);
            }
              }
            fflush(stdout);
            }

+         #endif

          }
        #endif
         else
          }
        #endif
         else