Testsuite: track newer GnuTLS behaviour

We have lost one log line, for a ciphers-negotiation failure on an early
host in a list from routing.  We still get something indicative if the
last one fails, so I'm going to let this pass.
Test 2025 will fail on earlier GnuTLS library versions as a result.

NONE no longer works as documented, in priority string for GnuTLS.

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index ff8064babc1e36ad2ef90efdb8e2ce5607787910..fd18a601e5bbd60cb2d617f65a713d6b206f13ee 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -1598,6 +1598,7 @@ uint verify;
 if (state->verify_requirement == VERIFY_NONE)
   return TRUE;
 
 if (state->verify_requirement == VERIFY_NONE)
   return TRUE;
 

+DEBUG(D_tls) debug_printf("TLS: checking peer certificate\n");

 *errstr = NULL;
 
 if ((rc = peer_status(state, errstr)) != OK)
 *errstr = NULL;
 
 if ((rc = peer_status(state, errstr)) != OK)


@@ -2068,7 +2069,10 @@ if (!state->tlsp->on_connect)
   }
 
 /* Now negotiate the TLS session. We put our own timer on it, since it seems
   }
 
 /* Now negotiate the TLS session. We put our own timer on it, since it seems

-that the GnuTLS library doesn't. */
+that the GnuTLS library doesn't.
+From 3.1.0 there is gnutls_handshake_set_timeout() - but it requires you
+to set (and clear down afterwards) up a pull-timeout callback function that does
+a select, so we're no better off unless avoiding signals becomes an issue. */

 
 gnutls_transport_set_ptr2(state->session,
     (gnutls_transport_ptr_t)(long) fileno(smtp_in),
 
 gnutls_transport_set_ptr2(state->session,
     (gnutls_transport_ptr_t)(long) fileno(smtp_in),

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index b2adeb555a260c5cdf92f41813adb0a905d9bc7b..d7e83966f70c9f5cbf667aa9254e3e5fe9b2af5f 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -2015,6 +2015,7 @@ if (  smtp_peer_options & OPTION_TLS
       /* TLS negotiation failed; give an error. From outside, this function may
       be called again to try in clear on a new connection, if the options permit
       it for this host. */
       /* TLS negotiation failed; give an error. From outside, this function may
       be called again to try in clear on a new connection, if the options permit
       it for this host. */

+      DEBUG(D_tls) debug_printf("TLS session fail: %s\n", errstr);

 
 # ifdef SUPPORT_DANE
       if (sx->dane)
 
 # ifdef SUPPORT_DANE
       if (sx->dane)


@@ -4746,6 +4747,7 @@ retry_non_continued:
           "hosts_max_try (message older than host's retry time)\n");
         }
       }
           "hosts_max_try (message older than host's retry time)\n");
         }
       }

+    if (f.running_in_test_harness) millisleep(500); /* let server debug out */

     }   /* End of loop for trying multiple hosts. */
 
   /* If we failed to find a matching host in the list, for an already-open
     }   /* End of loop for trying multiple hosts. */
 
   /* If we failed to find a matching host in the list, for an already-open

diff --git a/test/confs/2024 b/test/confs/2024
index 64502d56b75006eb838ea554e1edcea2c44707cf..ea3b2820653801fcbf2578074626b3cadcca9868 100644 (file)
--- a/test/confs/2024
+++ b/test/confs/2024
@@ -22,4 +22,6 @@ tls_verify_hosts = HOSTIPV4
 #tls_verify_certificates = TVC
 tls_verify_certificates = CERT
 
 #tls_verify_certificates = TVC
 tls_verify_certificates = CERT
 

+# so we can decode in wireshark
+tls_require_ciphers = NORMAL:-KX-ALL:+RSA

 # End
 # End

diff --git a/test/confs/2025 b/test/confs/2025
index feaa815a1d3213628618df8c78e25623a1878850..fdf1e04057ad2e707267b6c2453e99ed6110f65f 100644 (file)
--- a/test/confs/2025
+++ b/test/confs/2025
@@ -17,8 +17,7 @@ queue_run_in_order
 
 tls_advertise_hosts = *
 
 
 tls_advertise_hosts = *
 

-tls_require_ciphers = ${if eq{$sender_host_address}{HOSTIPV4}\
-                      {NONE}{SECURE256}}
+tls_require_ciphers = NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA256

 
 # Set certificate only if server
 
 
 # Set certificate only if server
 


@@ -45,9 +44,10 @@ send_to_server:
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4 : 127.0.0.1
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4 : 127.0.0.1

-  hosts_require_tls = HOSTIPV4

   port = PORT_D
   port = PORT_D

-
+  hosts_require_tls = HOSTIPV4
+  tls_require_ciphers = NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA\
+        ${if eq{$host}{HOSTIPV4} {384} {256} }

 
 # ----- Retry -----
 
 
 # ----- Retry -----
 

diff --git a/test/confs/5821 b/test/confs/5821
index 9b73181a91fbbcb08d25a9d589e55719fda66a52..86ddbdedd6d0e472dd741d0c78d47377e69170e0 100644 (file)
--- a/test/confs/5821
+++ b/test/confs/5821
@@ -23,7 +23,7 @@ tls_certificate = ${if eq {SERVER}{server} {CDIR2/fullchain.pem}fail}
 tls_privatekey =  ${if eq {SERVER}{server} {CDIR2/server1.example.com.unlocked.key}fail}
 
 # Permit two specific ciphers
 tls_privatekey =  ${if eq {SERVER}{server} {CDIR2/server1.example.com.unlocked.key}fail}
 
 # Permit two specific ciphers

-tls_require_ciphers = NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL
+tls_require_ciphers = NORMAL:-KX-ALL:+RSA:-CIPHER-ALL:+AES-128-CBC:+CAMELLIA-256-GCM

 
 # ----- Routers -----
 begin routers
 
 # ----- Routers -----
 begin routers


@@ -52,7 +52,7 @@ send_to_server:
   tls_verify_certificates =    CDIR2/ca_chain.pem
 
   # Some commonly-available cipher, we hope
   tls_verify_certificates =    CDIR2/ca_chain.pem
 
   # Some commonly-available cipher, we hope

-  tls_require_ciphers =                NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL
+  tls_require_ciphers =                NORMAL:-CIPHER-ALL:+AES-128-CBC

   dane_require_tls_ciphers =   OPT
 
 # ----- Retry -----
   dane_require_tls_ciphers =   OPT
 
 # ----- Retry -----

diff --git a/test/log/2024 b/test/log/2024
index f7f6619c0701823162c7a603b16d7ca21a46cc83..f16da49b7aa7f8f73be0b9381acd61746af0f84d 100644 (file)
--- a/test/log/2024
+++ b/test/log/2024
@@ -1,6 +1,6 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225

-1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (certificate verification failed): certificate invalid
+1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (gnutls_handshake): The peer did not send any certificate.

 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (cert/key setup: cert=/non/exist key=/non/exist): Error while reading file.
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (cert/key setup: cert=/non/exist key=/non/exist): Error while reading file.

diff --git a/test/log/2025 b/test/log/2025
index 2b015d5cdff37506211b621f78a50987d33f52c7..7faa00e618463a822f1003d46736e3e4a7e3d782 100644 (file)
--- a/test/log/2025
+++ b/test/log/2025
@@ -1,6 +1,5 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf

-1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4]: a TLS session is required, but an attempt to start TLS failed

 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke_RSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/runtest b/test/runtest
index 7a7f661ba217d1f27c6caec1812b3afef2a675f0..7921c5beec6ce171c00f6a96507cfa77cd0c8825 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -596,6 +596,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/No certificate was found/The peer did not send any certificate/g;
 #(dodgy test?)  s/\(certificate verification failed\): invalid/\(gnutls_handshake\): The peer did not send any certificate./g;
   s/\(gnutls_priority_set\): No or insufficient priorities were set/\(gnutls_handshake\): Could not negotiate a supported cipher suite/g;
   s/No certificate was found/The peer did not send any certificate/g;
 #(dodgy test?)  s/\(certificate verification failed\): invalid/\(gnutls_handshake\): The peer did not send any certificate./g;
   s/\(gnutls_priority_set\): No or insufficient priorities were set/\(gnutls_handshake\): Could not negotiate a supported cipher suite/g;

+  s/\(gnutls_handshake\): \KNo supported cipher suites have been found.$/Could not negotiate a supported cipher suite./;

 
   # (this new one is a generic channel-read error, but the testsuite
   # only hits it in one place)
 
   # (this new one is a generic channel-read error, but the testsuite
   # only hits it in one place)


@@ -1568,6 +1569,11 @@ $munges =
     'gnutls_handshake' =>
     { 'mainlog' => 's/\(gnutls_handshake\): Error in the push function/\(gnutls_handshake\): A TLS packet with unexpected length was received/' },
 
     'gnutls_handshake' =>
     { 'mainlog' => 's/\(gnutls_handshake\): Error in the push function/\(gnutls_handshake\): A TLS packet with unexpected length was received/' },
 

+    'gnutls_bad_clientcert' =>
+    { 'mainlog' => 's/\(certificate verification failed\): certificate invalid/\(gnutls_handshake\): The peer did not send any certificate./',
+      'stdout'  => 's/Succeeded in starting TLS/A TLS fatal alert has been received.\nFailed to start TLS'
+    },
+

     'optional_events' =>
     { 'stdout' => '/event_action =/' },
 
     'optional_events' =>
     { 'stdout' => '/event_action =/' },
 

diff --git a/test/scripts/2000-GnuTLS/2024 b/test/scripts/2000-GnuTLS/2024
index 7e16b7b053693e75d0521bf4d439cc7492f1abb8..a2ad20446cf145a58ccc94746bb2ab08a89cef4d 100644 (file)
--- a/test/scripts/2000-GnuTLS/2024
+++ b/test/scripts/2000-GnuTLS/2024
@@ -2,6 +2,13 @@
 gnutls
 exim -DSERVER=server -bd -oX PORT_D
 ****
 gnutls
 exim -DSERVER=server -bd -oX PORT_D
 ****

+#
+#
+# This one has a cert, but the server isn't expecting it.
+# Earlier versions of GnuTLS would send it despite the server giving a list of acceptable ones, and the
+# server would fail its verification.  Now the client correctly doesn't send it; the mainlog reflects
+# this, the custom munge patches output with old GnuTLS (I hope; not actually tested).
+munge gnutls_bad_clientcert

 client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
 ??? 220
 ehlo rhu.barb
 client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
 ??? 220
 ehlo rhu.barb


@@ -15,6 +22,8 @@ starttls
 ??? 220
 ****
 killdaemon
 ??? 220
 ****
 killdaemon

+#
+# Here the server really doesn't have a cert

 exim -DSERVER=server -DCERT=/non/exist -bd -oX PORT_D
 ****
 client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
 exim -DSERVER=server -DCERT=/non/exist -bd -oX PORT_D
 ****
 client-gnutls HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2

diff --git a/test/scripts/2000-GnuTLS/2025 b/test/scripts/2000-GnuTLS/2025
index 38ffccf84980832dfaeb49efa8ef5b53272f3a79..892651e685a8e5723d7aa479bbbac7b489219ad5 100644 (file)
--- a/test/scripts/2000-GnuTLS/2025
+++ b/test/scripts/2000-GnuTLS/2025
@@ -7,5 +7,6 @@ Testing
 ****
 exim -qf
 ****
 ****
 exim -qf
 ****

+millisleep 500

 killdaemon
 no_msglog_check
 killdaemon
 no_msglog_check

diff --git a/test/scripts/5820-DANE-GnuTLS/5821 b/test/scripts/5820-DANE-GnuTLS/5821
index f4ea30564474d6327b6a4caa32042f3dcdcfb9a6..7f83a401bb118933246b389adbbc40b67a07d77a 100644 (file)
--- a/test/scripts/5820-DANE-GnuTLS/5821
+++ b/test/scripts/5820-DANE-GnuTLS/5821
@@ -16,12 +16,12 @@ Testing
 #
 ### Dane cipher specified, dane unused
 # Since dane unused, should get the same cipher as the baseline
 #
 ### Dane cipher specified, dane unused
 # Since dane unused, should get the same cipher as the baseline

-exim -odf -DOPT=NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL CALLER@localhost.test.ex
+exim -odf -DOPT=NORMAL:-CIPHER-ALL:+CAMELLIA-256-GCM CALLER@localhost.test.ex

 Testing
 ****
 ### Dane cipher specified, dane used
 # Should get the cipher specified here
 Testing
 ****
 ### Dane cipher specified, dane used
 # Should get the cipher specified here

-exim -odf -DOPT=NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+CAMELLIA-256-GCM:+SIGN-ALL:+COMP-NULL CALLER@dane256ee.test.ex
+exim -odf -DOPT=NORMAL:-CIPHER-ALL:+CAMELLIA-256-GCM CALLER@dane256ee.test.ex

 Testing
 ****
 #
 Testing
 ****
 #

diff --git a/test/stdout/2024 b/test/stdout/2024
index ecedd4193d1279f742cd83f2f1c9cd795b108881..b25f1c8f40cb742abb825407182f2e0a1b33d754 100644 (file)
--- a/test/stdout/2024
+++ b/test/stdout/2024
@@ -20,7 +20,8 @@ Key file = aux-fixed/cert2
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS

-Succeeded in starting TLS
+A TLS fatal alert has been received.
+Failed to start TLS

 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Certificate file = aux-fixed/cert2
 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Certificate file = aux-fixed/cert2