From 22c73272a854ecd9421b0a14dc333ff429efecc3 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 20 Aug 2026 17:16:58 +0200 Subject: [PATCH 1/2] Preserve server TLS request without TLS support --- src/relpsrv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/relpsrv.c b/src/relpsrv.c index 87cff59e..a386bba9 100644 --- a/src/relpsrv.c +++ b/src/relpsrv.c @@ -356,9 +356,8 @@ PART_OF_API relpRetVal relpSrvEnableTLS2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis) { ENTER_RELPFUNC; -#if defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL) pThis->bEnableTLS = 1; -#else +#if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) iRet = RELP_RET_ERR_NO_TLS; #endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */ LEAVE_RELPFUNC; @@ -367,9 +366,8 @@ PART_OF_API relpRetVal relpSrvEnableTLSZip2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis) { ENTER_RELPFUNC; -#if defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL) pThis->bEnableTLSZip = 1; -#else +#if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) iRet = RELP_RET_ERR_NO_TLS; #endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */ LEAVE_RELPFUNC; From 1ca58dc5920883c31aaee1f3fe609f5d225084d6 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 20 Aug 2026 18:21:33 +0200 Subject: [PATCH 2/2] test: cover TLS requests without TLS support --- src/relpsrv.c | 10 ++++++---- tests/Makefile.am | 8 ++++++++ tests/tls-request-no-tls.c | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 tests/tls-request-no-tls.c diff --git a/src/relpsrv.c b/src/relpsrv.c index a386bba9..15e72297 100644 --- a/src/relpsrv.c +++ b/src/relpsrv.c @@ -353,23 +353,25 @@ relpSrvSetDHBits(relpSrv_t *const pThis, int bits) pThis->dhBits = bits; } PART_OF_API relpRetVal -relpSrvEnableTLS2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis) +relpSrvEnableTLS2(relpSrv_t *const pThis) { ENTER_RELPFUNC; + RELPOBJ_assert(pThis, Srv); pThis->bEnableTLS = 1; #if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) iRet = RELP_RET_ERR_NO_TLS; -#endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */ +#endif /* !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) */ LEAVE_RELPFUNC; } PART_OF_API relpRetVal -relpSrvEnableTLSZip2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis) +relpSrvEnableTLSZip2(relpSrv_t *const pThis) { ENTER_RELPFUNC; + RELPOBJ_assert(pThis, Srv); pThis->bEnableTLSZip = 1; #if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) iRet = RELP_RET_ERR_NO_TLS; -#endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */ +#endif /* !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) */ LEAVE_RELPFUNC; } PART_OF_API void diff --git a/tests/Makefile.am b/tests/Makefile.am index 2ad93bf3..0105c2b8 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -119,6 +119,13 @@ TESTS= selftest_receive_watchdog.sh \ send-noconnect.sh \ send-dummyserver-no-waitstate-errmsg.sh \ receive-emptyconnect.sh +if !ENABLE_TLS_GENERIC +check_PROGRAMS+=tls-request-no-tls +tls_request_no_tls_SOURCES=tls-request-no-tls.c +tls_request_no_tls_LDADD=../src/.libs/librelp.a $(rt_libs) $(socket_libs) $(pthread_libs) +tls_request_no_tls_CFLAGS=$(AM_CFLAGS) -I${top_srcdir}/src $(WARN_CFLAGS) +TESTS+=tls-request-no-tls +endif if ENABLE_TLS_GENERIC TESTS+=$(TLS_TESTS) endif @@ -179,6 +186,7 @@ EXTRA_DIST=$(TESTS) \ permitted-peer-lifetime.c \ tls-openssl-retry-state.sh \ tls-openssl-retry-state.c \ + tls-request-no-tls.c \ tls-certs/ca.pem \ tls-certs/cert.pem \ tls-certs/key.pem \ diff --git a/tests/tls-request-no-tls.c b/tests/tls-request-no-tls.c new file mode 100644 index 00000000..8e349897 --- /dev/null +++ b/tests/tls-request-no-tls.c @@ -0,0 +1,33 @@ +/* + * Regression test for recording a server TLS request in a build without TLS + * support. The request must not fall through to a plaintext listener. + */ +#include +#include + +#include "config.h" +#include "librelp.h" +#include "relp.h" +#include "relpsrv.h" + +int +main(void) +{ + relpEngine_t *engine = NULL; + relpSrv_t *server = NULL; + + assert(relpEngineConstruct(&engine) == RELP_RET_OK); + assert(relpEngineListnerConstruct(engine, &server) == RELP_RET_OK); + + assert(relpSrvEnableTLS2(server) == RELP_RET_ERR_NO_TLS); + assert(relpSrvEnableTLSZip2(server) == RELP_RET_ERR_NO_TLS); + assert(server->bEnableTLS == 1); + assert(server->bEnableTLSZip == 1); + + assert(relpSrvRun(server) == RELP_RET_ERR_NO_TLS); + assert(server->pTcp == NULL); + + assert(relpSrvDestruct(&server) == RELP_RET_OK); + assert(relpEngineDestruct(&engine) == RELP_RET_OK); + return 0; +}