aptwebserver: Refuse client immediately on TLS handshake

We implement a HTTP-only server here (that is wrapped by stunnel for
HTTPS support), so if a TLS handshake reaches us it is always wrong
and we can just close the connection immediately instead of accepting
it and letting the client run into a timeout as we will never receive
the message(s) we expect.

This happens e.g. with browsers like Firefox that opportunistically
try https first (even if you ask for http and specify a port).

2 files changed, 12 insertions, 8 deletions

diff --git a/test/integration/test-apt-helper b/test/integration/test-apt-helper
index 4f883b440..7c16d291e 100755
--- a/test/integration/test-apt-helper
+++ b/test/integration/test-apt-helper
@@ -12,6 +12,11 @@ changetohttpswebserver
 echo 'foo' > aptarchive/foo
 echo 'bar' > aptarchive/foo2
 
+msgtest 'aptwebserver instantly resets connection' 'on HTTP-only TLS'
+# the reported error is currently (but that seems a bit brittle to check for explicitly):
+#  SSL connection failed: error:00000000:lib(0)::reason(0) / Connection reset by peer
+testfailure --nomsg apthelper download-file "https://localhost:${APTHTTPPORT}/foo" './downloaded/foo' -o Acquire::Retries=0
+
 test_apt_helper_download() {
     msgmsg 'Test with' "$1"
 
diff --git a/test/integration/test-apt-https-transient b/test/integration/test-apt-https-transient
index f2b7347ba..9fd70942f 100755
--- a/test/integration/test-apt-https-transient
+++ b/test/integration/test-apt-https-transient
@@ -24,18 +24,17 @@ testfileequal httpfile 'alright'
 rm -f httpfile httpsfile
 
 # Speak wrong protocols (https on http port and vice versa). We check that they can be retried.
-
 msgtest 'protocol negotiation error is transient for' 'https'
-testfailureequal "Ign:1 https://localhost:${APTHTTPPORT}/working
-  Could not wait for server fd - select (11: Resource temporarily unavailable)
-Err:1 https://localhost:${APTHTTPPORT}/working
-  Could not wait for server fd - select (11: Resource temporarily unavailable)
-E: Failed to fetch https://localhost:${APTHTTPPORT}/working  Could not wait for server fd - select (11: Resource temporarily unavailable)
-E: Download Failed" apthelper download-file "https://localhost:${APTHTTPPORT}/working" httpfile -oAcquire::https::Timeout=1 -oAcquire::Retries=1
+testfailure --nomsg apthelper download-file "https://localhost:${APTHTTPPORT}/working" httpfile -oAcquire::https::Timeout=1 -oAcquire::Retries=1
+cp -a rootdir/tmp/testfailure.output httpsonhttp.output
+# the error details produced seem a bit too internal to hardcode them here:
+#  SSL connection failed: error:00000000:lib(0)::reason(0) / Connection reset by peer
+testsuccess grep "^Ign:1 https://localhost:${APTHTTPPORT}/working$" httpsonhttp.output
+testsuccess grep "^Err:1 https://localhost:${APTHTTPPORT}/working$" httpsonhttp.output
 
 # Speak wrong protocols (https on http port and vice versa)
 msgtest 'protocol negotiation error is transient for' 'http'
-testfailureequal "Ign:1 http://localhost:${APTHTTPSPORT}/working
+testfailureequal --nomsg "Ign:1 http://localhost:${APTHTTPSPORT}/working
   Connection failed
 Err:1 http://localhost:${APTHTTPSPORT}/working
   Connection failed