Preserve server TLS request flags when TLS is disabled (prevent fail-open)

src/relpsrv.c

@@ -353,25 +353,25 @@ relpSrvSetDHBits(relpSrv_t *const pThis, int bits)
 	pThis->dhBits = bits;
 }
 PART_OF_API relpRetVal
-relpSrvEnableTLS2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis)
+relpSrvEnableTLS2(relpSrv_t *const pThis)
 {
 	ENTER_RELPFUNC;
-#if defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)
+	RELPOBJ_assert(pThis, Srv);
 	pThis->bEnableTLS = 1;
-#else
+#if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL))
 	iRet = RELP_RET_ERR_NO_TLS;
-#endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */
+#endif /* !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) */
 	LEAVE_RELPFUNC;
 }
 PART_OF_API relpRetVal
-relpSrvEnableTLSZip2(relpSrv_t LIBRELP_ATTR_UNUSED *pThis)
+relpSrvEnableTLSZip2(relpSrv_t *const pThis)
 {
 	ENTER_RELPFUNC;
-#if defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)
+	RELPOBJ_assert(pThis, Srv);
 	pThis->bEnableTLSZip = 1;
-#else
+#if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL))
 	iRet = RELP_RET_ERR_NO_TLS;
-#endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */
+#endif /* !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) */
 	LEAVE_RELPFUNC;
 }
 PART_OF_API void

tests/Makefile.am

@@ -119,6 +119,13 @@ TESTS=  selftest_receive_watchdog.sh \
 	send-noconnect.sh \
 	send-dummyserver-no-waitstate-errmsg.sh \
 	receive-emptyconnect.sh
+if !ENABLE_TLS_GENERIC
+check_PROGRAMS+=tls-request-no-tls
+tls_request_no_tls_SOURCES=tls-request-no-tls.c
+tls_request_no_tls_LDADD=../src/.libs/librelp.a $(rt_libs) $(socket_libs) $(pthread_libs)
+tls_request_no_tls_CFLAGS=$(AM_CFLAGS) -I${top_srcdir}/src $(WARN_CFLAGS)
+TESTS+=tls-request-no-tls
+endif
 if ENABLE_TLS_GENERIC
 TESTS+=$(TLS_TESTS)
 endif
@@ -179,6 +186,7 @@ EXTRA_DIST=$(TESTS) \
 	permitted-peer-lifetime.c \
 	tls-openssl-retry-state.sh \
 	tls-openssl-retry-state.c \
+	tls-request-no-tls.c \
 	tls-certs/ca.pem \
 	tls-certs/cert.pem \
 	tls-certs/key.pem \

tests/tls-request-no-tls.c

@@ -0,0 +1,33 @@
+/*
+ * Regression test for recording a server TLS request in a build without TLS
+ * support. The request must not fall through to a plaintext listener.
+ */
+#include <assert.h>
+#include <stddef.h>
+
+#include "config.h"
+#include "librelp.h"
+#include "relp.h"
+#include "relpsrv.h"
+
+int
+main(void)
+{
+	relpEngine_t *engine = NULL;
+	relpSrv_t *server = NULL;
+
+	assert(relpEngineConstruct(&engine) == RELP_RET_OK);
+	assert(relpEngineListnerConstruct(engine, &server) == RELP_RET_OK);
+
+	assert(relpSrvEnableTLS2(server) == RELP_RET_ERR_NO_TLS);
+	assert(relpSrvEnableTLSZip2(server) == RELP_RET_ERR_NO_TLS);
+	assert(server->bEnableTLS == 1);
+	assert(server->bEnableTLSZip == 1);
+
+	assert(relpSrvRun(server) == RELP_RET_ERR_NO_TLS);
+	assert(server->pTcp == NULL);
+
+	assert(relpSrvDestruct(&server) == RELP_RET_OK);
+	assert(relpEngineDestruct(&engine) == RELP_RET_OK);
+	return 0;
+}