curl/tests/data/test982

<testcase>
<info>
<keywords>
POP3
STARTTLS
</keywords>
</info>

#
# Server-side
<reply>
<servercmd>
CAPA STLS USER
REPLY STLS -ERR currently unavailable\r\n+OK user accepted\r\n+OK authenticated
REPLY PASS -ERR Authentication credentials invalid
</servercmd>
<data nocheck="yes">
From: me@somewhere
To: fake@nowhere

body

--
  yours sincerely
</data>
</reply>

#
# Client-side
<client>
<features>
SSL
</features>
<server>
pop3
</server>
<name>
POP3 STARTTLS pipelined server response
</name>
<command>
pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl
 </command>
</client>

#
# Verify data after the test has been "shot"
<verify>
# 8 is CURLE_WEIRD_SERVER_REPLY
<errorcode>
8
</errorcode>
<protocol>
CAPA
STLS
</protocol>
</verify>
</testcase>
ftp,imap,pop3,smtp: reject STARTTLS server response pipelining If a server pipelines future responses within the STARTTLS response, the former are preserved in the pingpong cache across TLS negotiation and used as responses to the encrypted commands. This fix detects pipelined STARTTLS responses and rejects them with an error. CVE-2021-22947 Bug: https://curl.se/docs/CVE-2021-22947.html 2021-09-07 19:26:42 +08:00			`<testcase>`
			`<info>`
			`<keywords>`
			`POP3`
			`STARTTLS`
			`</keywords>`
			`</info>`

			`#`
			`# Server-side`
			`<reply>`
			`<servercmd>`
			`CAPA STLS USER`
			`REPLY STLS -ERR currently unavailable\r\n+OK user accepted\r\n+OK authenticated`
			`REPLY PASS -ERR Authentication credentials invalid`
			`</servercmd>`
			`<data nocheck="yes">`
			`From: me@somewhere`
			`To: fake@nowhere`

			`body`

			`--`
			`yours sincerely`
			`</data>`
			`</reply>`

			`#`
			`# Client-side`
			`<client>`
			`<features>`
			`SSL`
			`</features>`
			`<server>`
			`pop3`
			`</server>`
tests: remove leading spaces from some tags The threee tags `<name>`, `</name>` and `<command>` were frequently used with a leading space that this removes. The reason this habbit is so widespread in testcases is probably that they have been copy and pasted. Hence, fixing them all now might curb this practice from now on. Closes #12028 2023-10-04 17:35:54 +08:00			`<name>`
ftp,imap,pop3,smtp: reject STARTTLS server response pipelining If a server pipelines future responses within the STARTTLS response, the former are preserved in the pingpong cache across TLS negotiation and used as responses to the encrypted commands. This fix detects pipelined STARTTLS responses and rejects them with an error. CVE-2021-22947 Bug: https://curl.se/docs/CVE-2021-22947.html 2021-09-07 19:26:42 +08:00			`POP3 STARTTLS pipelined server response`
tests: remove leading spaces from some tags The threee tags `<name>`, `</name>` and `<command>` were frequently used with a leading space that this removes. The reason this habbit is so widespread in testcases is probably that they have been copy and pasted. Hence, fixing them all now might curb this practice from now on. Closes #12028 2023-10-04 17:35:54 +08:00			`</name>`
			`<command>`
ftp,imap,pop3,smtp: reject STARTTLS server response pipelining If a server pipelines future responses within the STARTTLS response, the former are preserved in the pingpong cache across TLS negotiation and used as responses to the encrypted commands. This fix detects pipelined STARTTLS responses and rejects them with an error. CVE-2021-22947 Bug: https://curl.se/docs/CVE-2021-22947.html 2021-09-07 19:26:42 +08:00			`pop3://%HOSTIP:%POP3PORT/%TESTNUMBER -u user:secret --ssl`
			`</command>`
			`</client>`

			`#`
			`# Verify data after the test has been "shot"`
			`<verify>`
			`# 8 is CURLE_WEIRD_SERVER_REPLY`
			`<errorcode>`
			`8`
			`</errorcode>`
			`<protocol>`
			`CAPA`
			`STLS`
			`</protocol>`
			`</verify>`
			`</testcase>`