2 * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008,
3 * 2009, 2010 Free Software Foundation, Inc.
5 * This file is part of GnuTLS.
7 * GnuTLS is free software: you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * GnuTLS is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program. If not, see
19 * <http://www.gnu.org/licenses/>.
26 #include <sys/types.h>
28 #include <gnutls/gnutls.h>
29 #include <gnutls/extra.h>
31 #include <sys/socket.h>
34 #include <tls_test-gaa.h>
36 /* Gnulib portability files. */
38 #include <version-etc.h>
41 #define ERR(err,s) if (err==-1) {perror(s);return(1);}
44 /* global stuff here */
46 const char *hostname
= NULL
;
52 gnutls_srp_client_credentials_t srp_cred
;
53 gnutls_anon_client_credentials_t anon_cred
;
54 gnutls_certificate_credentials_t xcred
;
56 /* end of global stuff */
66 tls_log_func (int level
, const char *str
)
68 fprintf (stderr
, "|<%d>| %s", level
, str
);
71 typedef test_code_t (*TEST_FUNC
) (gnutls_session_t
);
75 const char *test_name
;
79 const char *unsure_str
;
82 static const TLS_TEST tls_tests
[] = {
83 {"for SSL 3.0 support", test_ssl3
, "yes", "no", "dunno"},
84 {"whether \%COMPAT is required", test_record_padding
, "no", "yes", "dunno"},
85 {"for TLS 1.0 support", test_tls1
, "yes", "no", "dunno"},
86 {"for TLS 1.1 support", test_tls1_1
, "yes", "no", "dunno"},
87 {"fallback from TLS 1.1 to", test_tls1_1_fallback
, "TLS 1.0", "failed",
89 {"for TLS 1.2 support", test_tls1_2
, "yes", "no", "dunno"},
90 /* this test will disable TLS 1.0 if the server is
92 {"whether we need to disable TLS 1.0", test_tls_disable
, "no", "yes",
94 {"for Safe renegotiation support", test_safe_renegotiation
, "yes", "no",
96 {"for Safe renegotiation support (SCSV)", test_safe_renegotiation_scsv
,
97 "yes", "no", "dunno"},
98 {"for HTTPS server name", test_server
, "", "failed", "not checked"},
99 {"for version rollback bug in RSA PMS", test_rsa_pms
, "no", "yes",
101 {"for version rollback bug in Client Hello", test_version_rollback
,
102 "no", "yes", "dunno"},
105 {"whether the server ignores the RSA PMS version",
106 test_rsa_pms_version_check
, "yes", "no", "dunno"},
107 {"whether the server can accept Hello Extensions",
108 test_hello_extension
, "yes", "no", "dunno"},
109 {"whether the server can accept cipher suites not in SSL 3.0 spec",
110 test_unknown_ciphersuites
, "yes", "no", "dunno"},
111 {"whether the server can accept a bogus TLS record version in the client hello", test_version_oob
, "yes", "no", "dunno"},
112 {"for certificate information", test_certificate
, "", "", ""},
113 {"for trusted CAs", test_server_cas
, "", "", ""},
114 {"whether the server understands TLS closure alerts", test_bye
, "yes",
116 /* the fact that is after the closure alert test does matter.
118 {"whether the server supports session resumption",
119 test_session_resume2
, "yes", "no", "dunno"},
120 {"for export-grade ciphersuite support", test_export
, "yes", "no",
122 {"RSA-export ciphersuite info", test_export_info
, "", "N/A", "N/A"},
124 {"for anonymous authentication support", test_anonymous
, "yes", "no",
126 {"anonymous Diffie-Hellman group info", test_dhe_group
, "", "N/A",
129 {"for ephemeral Diffie-Hellman support", test_dhe
, "yes", "no",
131 {"ephemeral Diffie-Hellman group info", test_dhe_group
, "", "N/A",
133 {"for AES cipher support (TLS extension)", test_aes
, "yes", "no",
135 #ifdef ENABLE_CAMELLIA
136 {"for CAMELLIA cipher support (TLS extension)", test_camellia
, "yes", "no",
139 {"for 3DES cipher support", test_3des
, "yes", "no", "dunno"},
140 {"for ARCFOUR 128 cipher support", test_arcfour
, "yes", "no", "dunno"},
141 {"for ARCFOUR 40 cipher support", test_arcfour_40
, "yes", "no",
143 {"for MD5 MAC support", test_md5
, "yes", "no", "dunno"},
144 {"for SHA1 MAC support", test_sha
, "yes", "no", "dunno"},
146 {"for ZLIB compression support (TLS extension)", test_zlib
, "yes",
149 {"for max record size (TLS extension)", test_max_record_size
, "yes",
151 {"for OpenPGP authentication support (TLS extension)", test_openpgp1
,
152 "yes", "no", "dunno"},
153 {NULL
, NULL
, NULL
, NULL
, NULL
}
159 static void gaa_parser (int argc
, char **argv
);
162 main (int argc
, char **argv
)
166 gnutls_session_t state
;
167 char buffer
[MAX_BUF
+ 1];
169 struct addrinfo hints
, *res
, *ptr
;
171 set_program_name (argv
[0]);
172 gaa_parser (argc
, argv
);
175 signal (SIGPIPE
, SIG_IGN
);
180 if (gnutls_global_init () < 0)
182 fprintf (stderr
, "global state initialization error\n");
186 gnutls_global_set_log_function (tls_log_func
);
187 gnutls_global_set_log_level (debug
);
189 printf ("Resolving '%s'...\n", hostname
);
190 /* get server name */
191 memset (&hints
, 0, sizeof (hints
));
192 hints
.ai_socktype
= SOCK_STREAM
;
194 snprintf (portname
, sizeof (portname
), "%d", port
);
195 if ((err
= getaddrinfo (hostname
, portname
, &hints
, &res
)) != 0)
197 fprintf (stderr
, "Cannot resolve %s: %s\n", hostname
,
203 if (gnutls_certificate_allocate_credentials (&xcred
) < 0)
204 { /* space for 2 certificates */
205 fprintf (stderr
, "memory error\n");
211 if (gnutls_srp_allocate_client_credentials (&srp_cred
) < 0)
213 fprintf (stderr
, "memory error\n");
220 if (gnutls_anon_allocate_client_credentials (&anon_cred
) < 0)
222 fprintf (stderr
, "memory error\n");
232 if (tls_tests
[i
].test_name
== NULL
)
233 break; /* finished */
235 /* if neither of SSL3 and TLSv1 are supported, exit
237 if (i
> 6 && tls1_1_ok
== 0 && tls1_ok
== 0 && ssl3_ok
== 0)
240 "\nServer does not support any of SSL 3.0, TLS 1.0 and TLS 1.1\n");
245 for (ptr
= res
; ptr
!= NULL
; ptr
= ptr
->ai_next
)
247 sd
= socket (ptr
->ai_family
, ptr
->ai_socktype
, ptr
->ai_protocol
);
253 getnameinfo (ptr
->ai_addr
, ptr
->ai_addrlen
, buffer
, MAX_BUF
,
254 NULL
, 0, NI_NUMERICHOST
);
256 printf ("Connecting to '%s:%d'...\n", buffer
, port
);
257 if ((err
= connect (sd
, ptr
->ai_addr
, ptr
->ai_addrlen
)) != 0)
264 ERR (err
, "connect") gnutls_init (&state
, GNUTLS_CLIENT
);
265 gnutls_transport_set_ptr (state
, (gnutls_transport_ptr_t
)
266 gl_fd_to_handle (sd
));
270 printf ("Checking %s...", tls_tests
[i
].test_name
);
272 ret
= tls_tests
[i
].func (state
);
274 if (ret
== TEST_SUCCEED
)
275 printf (" %s\n", tls_tests
[i
].suc_str
);
276 else if (ret
== TEST_FAILED
)
277 printf (" %s\n", tls_tests
[i
].fail_str
);
278 else if (ret
== TEST_UNSURE
)
279 printf (" %s\n", tls_tests
[i
].unsure_str
);
280 else if (ret
== TEST_IGNORE
)
286 while (ret
== TEST_IGNORE
&& tls_tests
[i
].test_name
!= NULL
);
288 gnutls_deinit (state
);
290 shutdown (sd
, SHUT_RDWR
); /* no more receptions */
300 gnutls_srp_free_client_credentials (srp_cred
);
302 gnutls_certificate_free_credentials (xcred
);
304 gnutls_anon_free_client_credentials (anon_cred
);
306 gnutls_global_deinit ();
313 gaa_parser (int argc
, char **argv
)
315 if (gaa (argc
, argv
, &info
) != -1)
318 "Error in the arguments. Use the -h or --help parameters to get more info.\n");
323 if (info
.rest_args
== NULL
)
324 hostname
= "localhost";
326 hostname
= info
.rest_args
;
330 verbose
= info
.more_info
;
334 void tls_test_version (void);
337 tls_test_version (void)
339 const char *p
= PACKAGE_NAME
;
340 if (strcmp (gnutls_check_version (NULL
), PACKAGE_VERSION
) != 0)
342 version_etc (stdout
, "gnutls-cli-debug", p
, gnutls_check_version (NULL
),
343 "Nikos Mavrogiannopoulos", (char *) NULL
);