fix: FROM name globs for identity maps; transport fallback tests (#294, #219)

tests/test_transport_tls.c

@@ -3,8 +3,11 @@
 #include "test_utils.h"
 #include "transport_tcp.h"
 #include "transport_tls.h"
+#include <dirent.h>
+#include <netinet/in.h>
 #include <openssl/ssl.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <unistd.h>
 
 static void test_tls_global_init() {
@@ -71,9 +74,53 @@ static void test_server_create_tls_empty_certs() {
   EXPECT_NULL(s);
 }
 
+/* Count the process's open descriptors via /proc/self/fd (see the TCP tests). */
+static int tls_count_open_fds(void) {
+  DIR* dir = opendir("/proc/self/fd");
+  if (!dir)
+    return -1;
+  int count = 0;
+  const struct dirent* ent;
+  while ((ent = readdir(dir)) != NULL) {
+    if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
+      continue;
+    count++;
+  }
+  closedir(dir);
+  return count;
+}
+
+/* #219 AC3: client_connect_tls_ex() reuses the shared tcp_connect_socket_ex()
+ * for the TCP connect, and a later TLS-setup failure must release that
+ * descriptor.  Passing no CA path makes create_ssl_ctx() fail deterministically
+ * AFTER a successful TCP connect, so the cleanup path is exercised without a
+ * TLS handshake or a certificate.  (The multi-address fallback itself is covered
+ * by the shared tcp_connect_socket_ex() tests in test_transport_tcp.c, which the
+ * TLS entry point calls.) */
+static void test_client_connect_tls_releases_fd_on_setup_failure() {
+  Server* s = server_create(0);
+  EXPECT_NOT_NULL(s);
+  EXPECT_EQ_INT(listen(s->file_descriptor, 1), 0);
+  struct sockaddr_in bound;
+  socklen_t bound_len = sizeof(bound);
+  EXPECT_EQ_INT(getsockname(s->file_descriptor, (struct sockaddr*)&bound, &bound_len), 0);
+  int port = ntohs(bound.sin_port);
+
+  int before = tls_count_open_fds();
+  Client* c = client_create();
+  EXPECT_NOT_NULL(c);
+  EXPECT_FALSE(client_connect_tls(c, "127.0.0.1", port, NULL, NULL, NULL));
+  EXPECT_TRUE(c->file_descriptor == -1);
+  if (before >= 0)
+    EXPECT_EQ_INT(tls_count_open_fds(), before);
+  client_delete(c);
+  server_delete(&s);
+}
+
 void test_transport_tls() {
   test_tls_global_init();
   test_server_create_tls_without_certs();
   test_client_connect_tls_fail();
+  test_client_connect_tls_releases_fd_on_setup_failure();
   test_server_create_tls_empty_certs();
 }