Testsuite: force non-TLSv1.3 for (OpenSSL) cert-variable test

This maintains visibility of the cert choice required by the auth-method configuration.

Leave the bogus results from pre-1.1.1 OpenSSL library bug while the fixed version is not in common use.

diff --git a/test/confs/2102 b/test/confs/2102
index c9e00479bfc11ebebceb3da4e3c952e470671394..99f659fd2566f4a77617cf470cc3cde5126cb6a8 100644 (file)
--- a/test/confs/2102
+++ b/test/confs/2102
@@ -33,6 +33,9 @@ tls_verify_hosts = HOSTIPV4
 tls_verify_certificates = DRSA/server2.example.com/ca_chain.pem
 
 
+.ifdef _OPT_OPENSSL_NO_TLSV1_3_X
+openssl_options = +no_tlsv1_3
+.endif
 # ------ ACL ------
 
 begin acl

diff --git a/test/scripts/2100-OpenSSL/2102 b/test/scripts/2100-OpenSSL/2102
index 3904c50980619da587fa52aba019386237ffd9f3..3465235b0711a1956f125f9b3522f1c1b435ce90 100644 (file)
--- a/test/scripts/2100-OpenSSL/2102
+++ b/test/scripts/2100-OpenSSL/2102
@@ -1,8 +1,10 @@
 # TLS server: general ops and certificate extractions
 #
-# NOTE: current OpenSSL libraries return faulty my-cert information
-# when more than one is loaded, which the conf for this testcase does.
+# NOTE: OpenSSL libraries return faulty my-cert information prior to OpenSSL 1.1.1
+# when more than one cert is loaded, which the conf for this testcase does.
 # As a result the expansion done and logged is misleading.
+# While the golden log output is set to the misleading result, the testcase
+# will unfortunately fail on the fixed OpenSSL versions.
 #
 # Make RSA authentication the only acceptable
 exim -DSERVER=server -DORDER=RSA -bd -oX PORT_D
@@ -96,6 +98,8 @@ killdaemon
 #
 # make ECDSA authentication preferred
 # DEFAULT:+RSA should work but does not seem to
+# also, will fail under TLS1.3 because there is no choice of auth
+# - so we disable that in the conf
 exim -DSERVER=server -DORDER=ECDSA:RSA:!COMPLEMENTOFDEFAULT -bd -oX PORT_D
 ****
 client-ssl 127.0.0.1 PORT_D

diff --git a/test/src/client.c b/test/src/client.c
index 3a6b4ad3db3222cc151bea2ae1133146d7abab79..de36ef0651ee9bae0b524fb217ffaef3d52ef796 100644 (file)
--- a/test/src/client.c
+++ b/test/src/client.c
@@ -569,12 +569,31 @@ nextinput:
       alarm(timeout);
       if (srv->tls_active)
         {
-        #ifdef HAVE_OPENSSL
+#ifdef HAVE_OPENSSL
+       int error;
         rc = SSL_read(srv->ssl, inbuffer, bsiz - 1);
-        #endif
-        #ifdef HAVE_GNUTLS
+       if (rc <= 0)
+          switch (error = SSL_get_error(srv->ssl, rc))
+           {
+           case SSL_ERROR_ZERO_RETURN:
+             break;
+           case SSL_ERROR_SYSCALL:
+             printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break;
+             rc = -1;
+           case SSL_ERROR_SSL:
+             printf("%s\n", ERR_error_string(ERR_get_error(), NULL)); break;
+             SSL_shutdown(srv->ssl);
+             SSL_free(srv->ssl);
+             srv->tls_active = FALSE;
+             goto nextinput;
+           default:
+             printf("SSL error code %d\n", error);
+           }
+
+#endif
+#ifdef HAVE_GNUTLS
         rc = gnutls_record_recv(tls_session, CS inbuffer, bsiz - 1);
-        #endif
+#endif
         }
       else
         rc = read(srv->sock, inbuffer, bsiz);
@@ -591,6 +610,8 @@ nextinput:
           printf("Expected EOF read\n");
          continue;
          }
+       else if (resp_optional)
+         continue;     /* next scriptline */
        else
          {
          printf("Unexpected EOF read\n");