features.h; tls_validate_require_cipher: log flag & tests

Pull in <features.h> on Linux.
Switch readconf log from D_all (bug) to D_tls (though D_any would have
worked).
Modified runtest to handle clamped DH bits and
tls_validate_require_cipher added debug logging.

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 23c727c9291bafeb771ee22c8329de7241e84cb3..8c7dc7230d9d8a4974581341f2d6d6d6c32bcf73 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -146,6 +146,9 @@ PP/34 Validate tls_require_ciphers on startup, since debugging an invalid
       relatively easy to get wrong.  Should also expose TLS library linkage
       problems.
 
       relatively easy to get wrong.  Should also expose TLS library linkage
       problems.
 

+PP/35 Pull in <features.h> on Linux, for some portability edge-cases of
+      64-bit ${eval} (JH/03).
+

 
 Exim version 4.77
 -----------------
 
 Exim version 4.77
 -----------------

diff --git a/src/OS/os.h-Linux b/src/OS/os.h-Linux
index eb7036d0f9f76d204947b52af19bc1333b7a4e17..5186ec89dde44f645efa85bf55ae03954ed24b8a 100644 (file)
--- a/src/OS/os.h-Linux
+++ b/src/OS/os.h-Linux
@@ -1,5 +1,12 @@
 /* Exim: OS-specific C header file for Linux */
 
 /* Exim: OS-specific C header file for Linux */
 

+/* Some weird variants may require invocation with C99 and features.h
+inclusion to build, with the 64-bit arithmetic. Make compiler selection
+their problem, but build anyway. */
+
+#include <features.h>
+
+

 #define CRYPT_H
 #define GLIBC_IP_OPTIONS
 #define HAVE_MMAP
 #define CRYPT_H
 #define GLIBC_IP_OPTIONS
 #define HAVE_MMAP

diff --git a/src/src/readconf.c b/src/src/readconf.c
index 3235d4556a4ceaf941d2cb0095cb6728c0459a2b..c3ffe4f824625c7cb853f5f433dc539f1be4dcdf 100644 (file)
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -2824,7 +2824,7 @@ do {
   rc = waitpid(pid, &status, 0);
 } while (rc < 0 && errno == EINTR);
 
   rc = waitpid(pid, &status, 0);
 } while (rc < 0 && errno == EINTR);
 

-DEBUG(D_all)
+DEBUG(D_tls)

   debug_printf("tls_validate_require_cipher child %d ended: status=0x%x\n",
       (int)pid, status);
 
   debug_printf("tls_validate_require_cipher child %d ended: status=0x%x\n",
       (int)pid, status);
 

diff --git a/test/runtest b/test/runtest
index 5ac52ae5651317b435965d38216e76f532ce963f..3e961ca9857e0e25dc28a9effce54fc39221b633 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -28,9 +28,10 @@ $testversion = "4.80 (08-May-12)";
 # This gets embedded in the D-H params filename, and the value comes
 # from asking GnuTLS for "normal", but there appears to be no way to
 # use certtool/... to ask what that value currently is.  *sigh*
 # This gets embedded in the D-H params filename, and the value comes
 # from asking GnuTLS for "normal", but there appears to be no way to
 # use certtool/... to ask what that value currently is.  *sigh*

-# This value is correct as of GnuTLS 2.12.18.
-#
-$gnutls_dh_bits_normal = 2432;
+# We also clamp it because of NSS interop, see addition of tls_dh_max_bits.
+# This value is correct as of GnuTLS 2.12.18 as clamped by tls_dh_max_bits.
+# normal = 2432   tls_dh_max_bits = 2236
+$gnutls_dh_bits_normal = 2236;

 
 $cf = "bin/cf -exact";
 $cr = "\r";
 
 $cf = "bin/cf -exact";
 $cr = "\r";


@@ -716,7 +717,6 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   s/(TLS error on connection (?:from|to) .*? \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
 
 
   s/(TLS error on connection (?:from|to) .*? \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
 

-

   # ======== Maildir things ========
   # timestamp output in maildir processing
   s/(timestamp=|\(timestamp_only\): )\d+/$1ddddddd/g;
   # ======== Maildir things ========
   # timestamp output in maildir processing
   s/(timestamp=|\(timestamp_only\): )\d+/$1ddddddd/g;


@@ -849,6 +849,15 @@ RESET_AFTER_EXTRA_LINE_READ:
     # be the case
     next if /^changing group to \d+ failed: Operation not permitted/;
 
     # be the case
     next if /^changing group to \d+ failed: Operation not permitted/;
 

+    # We might not keep this check; rather than change all the tests, just
+    # ignore it as long as it succeeds; then we only need to change the
+    # TLS tests where tls_require_ciphers has been set.
+    if (m{^changed uid/gid: calling tls_validate_require_cipher}) {
+      my $discard = <IN>;
+      next;
+    }
+    next if /^tls_validate_require_cipher child \d+ ended: status=0x0/;
+

     # We invoke Exim with -D, so we hit this new messag as of Exim 4.73:
     next if /^macros_trusted overridden to true by whitelisting/;
 
     # We invoke Exim with -D, so we hit this new messag as of Exim 4.73:
     next if /^macros_trusted overridden to true by whitelisting/;