diff options
| author | David Kalnischkies <david@kalnischkies.de> | 2026-02-05 21:18:40 +0000 |
|---|---|---|
| committer | David Kalnischkies <david@kalnischkies.de> | 2026-06-10 13:07:30 +0000 |
| commit | 49e91b96d9faeca50ab0b212174744938d446132 (patch) | |
| tree | 6b31bc0201214aa2d10a51b2edbf30032fa49889 /test/integration/test-apt-https-transient | |
| parent | 5b49a25a292dd3ed2355fadaca68753a72eb2422 (diff) | |
aptwebserver: Refuse client immediately on TLS handshake
We implement a HTTP-only server here (that is wrapped by stunnel for
HTTPS support), so if a TLS handshake reaches us it is always wrong
and we can just close the connection immediately instead of accepting
it and letting the client run into a timeout as we will never receive
the message(s) we expect.
This happens e.g. with browsers like Firefox that opportunistically
try https first (even if you ask for http and specify a port).
Diffstat (limited to 'test/integration/test-apt-https-transient')
| -rwxr-xr-x | test/integration/test-apt-https-transient | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/test/integration/test-apt-https-transient b/test/integration/test-apt-https-transient index f2b7347ba..9fd70942f 100755 --- a/test/integration/test-apt-https-transient +++ b/test/integration/test-apt-https-transient @@ -24,18 +24,17 @@ testfileequal httpfile 'alright' rm -f httpfile httpsfile # Speak wrong protocols (https on http port and vice versa). We check that they can be retried. - msgtest 'protocol negotiation error is transient for' 'https' -testfailureequal "Ign:1 https://localhost:${APTHTTPPORT}/working - Could not wait for server fd - select (11: Resource temporarily unavailable) -Err:1 https://localhost:${APTHTTPPORT}/working - Could not wait for server fd - select (11: Resource temporarily unavailable) -E: Failed to fetch https://localhost:${APTHTTPPORT}/working Could not wait for server fd - select (11: Resource temporarily unavailable) -E: Download Failed" apthelper download-file "https://localhost:${APTHTTPPORT}/working" httpfile -oAcquire::https::Timeout=1 -oAcquire::Retries=1 +testfailure --nomsg apthelper download-file "https://localhost:${APTHTTPPORT}/working" httpfile -oAcquire::https::Timeout=1 -oAcquire::Retries=1 +cp -a rootdir/tmp/testfailure.output httpsonhttp.output +# the error details produced seem a bit too internal to hardcode them here: +# SSL connection failed: error:00000000:lib(0)::reason(0) / Connection reset by peer +testsuccess grep "^Ign:1 https://localhost:${APTHTTPPORT}/working$" httpsonhttp.output +testsuccess grep "^Err:1 https://localhost:${APTHTTPPORT}/working$" httpsonhttp.output # Speak wrong protocols (https on http port and vice versa) msgtest 'protocol negotiation error is transient for' 'http' -testfailureequal "Ign:1 http://localhost:${APTHTTPSPORT}/working +testfailureequal --nomsg "Ign:1 http://localhost:${APTHTTPSPORT}/working Connection failed Err:1 http://localhost:${APTHTTPSPORT}/working Connection failed |