jetmore / jetmore/swaks

Why does smtp-server.pl return the same cert multiple times

Open
#73 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Perl
Stars
1.3k
Forks
95
PR merge metrics
No merged PRs in 30d

Description

See test _exec-transactions/00200. smtp-server.pl is using the default cert, which is node.example.com.key/.crt

That test runs (more or less):
```
../../swaks --to user@host1.nodns.test.swaks.net --from recip@host1.nodns.test.swaks.net --helo hserver --tls --pipe '../server/smtp-server.pl --silent --domain pipe part-0000-connect-standard.txt part-0101-ehlo-all.txt part-0200-starttls-basic.txt part-0101-ehlo-all.txt part-1000-mail-basic.txt part-1100-rcpt-basic-accept.txt part-2500-data-accept-basic.txt part-3000-shutdown-accept.txt '
```

And the peer certs are reported as
```
=== TLS peer[0] DN="/C=US/ST=Indiana/O=Swaks Development (node.example.com, with-SAN)/CN=node.example.com/emailAddress=proj-swaks@jetmore.net"
=== notBefore=2023-11-03T14:50:10Z
=== notAfter=2033-09-11T14:50:10Z
=== subjectAltName=[ DNS:node.example.com ]
=== commonName=node.example.com
=== TLS peer[1] DN="/C=US/ST=Indiana/O=Swaks Development (node.example.com, with-SAN)/CN=node.example.com/emailAddress=proj-swaks@jetmore.net"
=== notBefore=2023-11-03T14:50:10Z
=== notAfter=2033-09-11T14:50:10Z
=== subjectAltName=[ DNS:node.example.com ]
=== commonName=node.example.com
=== TLS peer[2] DN="/C=US/ST=Indiana/O=Swaks Development (node.example.com, with-SAN)/CN=node.example.com/emailAddress=proj-swaks@jetmore.net"
=== notBefore=2023-11-03T14:50:10Z
=== notAfter=2033-09-11T14:50:10Z
=== subjectAltName=[ DNS:node.example.com ]
=== commonName=node.example.com
```

When I spin up smtp-server.pl on tcp and hit it with s_client, it also reports the same cert multiple times:

```
../server/smtp-server.pl --domain inet part-0000-connect-standard.txt part-0101-ehlo-all.txt part-0200-starttls-basic.txt part-0101-ehlo-all.txt part-1000-mail-basic.txt part-1100-rcpt-basic-accept.txt part-2500-data-accept-basic.txt part-3000-shutdown-accept.txt

openssl s_client -host 127.0.0.1 -port 11111 -starttls smtp
```

```
Connecting to 127.0.0.1
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 C=US, ST=Indiana, O=Swaks Development (node.example.com, with-SAN), CN=node.example.com, emailAddress=proj-swaks@jetmore.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C=US, ST=Indiana, O=Swaks Development (node.example.com, with-SAN), CN=node.example.com, emailAddress=proj-swaks@jetmore.net
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 C=US, ST=Indiana, O=Swaks Development (node.example.com, with-SAN), CN=node.example.com, emailAddress=proj-swaks@jetmore.net
verify return:1
```

Given that, I see this as an issue w/ smtp-server.pl, not with swaks, so I'm creating this issue and dropping it into the backlog. My logic is that swaks is actually correct - as a test tool,, if the peer is returning the same cert 3 times, I want to know that. But my preference is that most tests work as expected (one cert), with only one or two "does it report the same cert multiple times when presented multiple times" tests

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with _exec-transactions/00200 and the smtp-server.pl invocation shown in the issue, then reproduce it with the listed swaks command or openssl s_client. Trace how the server presents certificates during STARTTLS. Done means ordinary tests report one certificate, while retaining one or two tests that intentionally verify repeated certificates.

Written by the indexing model from the issue text.

Assessment

Tech stack
perl
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.