2 * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2006, 2007, 2008, 2009,
3 * 2010 Free Software Foundation, Inc.
5 * This file is part of GNUTLS.
7 * GNUTLS is free software: you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * GNUTLS is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program. If not, see
19 * <http://www.gnu.org/licenses/>.
23 #include <gnutls/gnutls.h>
24 #include <gnutls/extra.h>
25 #include <gnutls/x509.h>
40 extern gnutls_srp_client_credentials_t srp_cred
;
41 extern gnutls_anon_client_credentials_t anon_cred
;
42 extern gnutls_certificate_credentials_t xcred
;
50 /* keep session info */
51 static char *session_data
= NULL
;
52 static char session_id
[32];
53 static size_t session_data_size
= 0, session_id_size
= 0;
55 static int handshake_output
= 0;
58 do_handshake (gnutls_session_t session
)
64 ret
= gnutls_handshake (session
);
66 while (ret
== GNUTLS_E_INTERRUPTED
|| ret
== GNUTLS_E_AGAIN
);
68 handshake_output
= ret
;
70 if (ret
< 0 && verbose
> 1)
72 if (ret
== GNUTLS_E_WARNING_ALERT_RECEIVED
73 || ret
== GNUTLS_E_FATAL_ALERT_RECEIVED
)
75 alert
= gnutls_alert_get (session
);
77 printf ("*** Received alert [%d]: %s\n",
78 alert
, gnutls_alert_get_name (alert
));
85 gnutls_session_get_data (session
, NULL
, &session_data_size
);
92 session_data
= malloc (session_data_size
);
94 if (session_data
== NULL
)
96 fprintf (stderr
, "Memory error\n");
99 gnutls_session_get_data (session
, session_data
, &session_data_size
);
101 session_id_size
= sizeof (session_id
);
102 gnutls_session_get_id (session
, session_id
, &session_id_size
);
107 static int protocol_priority
[16] = { GNUTLS_TLS1
, GNUTLS_SSL3
, 0 };
109 static const int kx_priority
[16] =
110 { GNUTLS_KX_RSA
, GNUTLS_KX_DHE_DSS
, GNUTLS_KX_DHE_RSA
,
112 GNUTLS_KX_RSA_EXPORT
, 0
115 static const int cipher_priority
[16] =
116 { GNUTLS_CIPHER_3DES_CBC
, GNUTLS_CIPHER_ARCFOUR_128
,
117 GNUTLS_CIPHER_ARCFOUR_40
, 0
119 static const int comp_priority
[16] = { GNUTLS_COMP_NULL
, 0 };
120 static const int mac_priority
[16] = { GNUTLS_MAC_SHA1
, GNUTLS_MAC_MD5
, 0 };
121 static const int cert_type_priority
[16] = { GNUTLS_CRT_X509
, 0 };
123 #define ADD_ALL_CIPHERS(session) gnutls_cipher_set_priority(session, cipher_priority)
124 #define ADD_ALL_COMP(session) gnutls_compression_set_priority(session, comp_priority)
125 #define ADD_ALL_MACS(session) gnutls_mac_set_priority(session, mac_priority)
126 #define ADD_ALL_KX(session) gnutls_kx_set_priority(session, kx_priority)
127 #define ADD_ALL_PROTOCOLS(session) gnutls_protocol_set_priority(session, protocol_priority)
128 #define ADD_ALL_CERTTYPES(session) gnutls_certificate_type_set_priority(session, cert_type_priority)
131 ADD_KX (gnutls_session_t session
, int kx
)
133 static int _kx_priority
[] = { 0, 0 };
134 _kx_priority
[0] = kx
;
136 gnutls_kx_set_priority (session
, _kx_priority
);
140 ADD_KX2 (gnutls_session_t session
, int kx1
, int kx2
)
142 static int _kx_priority
[] = { 0, 0, 0 };
143 _kx_priority
[0] = kx1
;
144 _kx_priority
[1] = kx2
;
146 gnutls_kx_set_priority (session
, _kx_priority
);
150 ADD_CIPHER (gnutls_session_t session
, int cipher
)
152 static int _cipher_priority
[] = { 0, 0 };
153 _cipher_priority
[0] = cipher
;
155 gnutls_cipher_set_priority (session
, _cipher_priority
);
159 ADD_CIPHER4 (gnutls_session_t session
, int cipher1
, int cipher2
, int cipher3
,
162 static int _cipher_priority
[] = { 0, 0, 0, 0, 0 };
163 _cipher_priority
[0] = cipher1
;
164 _cipher_priority
[1] = cipher2
;
165 _cipher_priority
[2] = cipher3
;
166 _cipher_priority
[3] = cipher4
;
168 gnutls_cipher_set_priority (session
, _cipher_priority
);
172 ADD_MAC (gnutls_session_t session
, int mac
)
174 static int _mac_priority
[] = { 0, 0 };
175 _mac_priority
[0] = mac
;
177 gnutls_mac_set_priority (session
, _mac_priority
);
181 ADD_COMP (gnutls_session_t session
, int c
)
183 static int _comp_priority
[] = { 0, 0 };
184 _comp_priority
[0] = c
;
186 gnutls_compression_set_priority (session
, _comp_priority
);
190 ADD_CERTTYPE (gnutls_session_t session
, int ctype
)
192 static int _ct_priority
[] = { 0, 0 };
193 _ct_priority
[0] = ctype
;
195 gnutls_certificate_type_set_priority (session
, _ct_priority
);
199 ADD_PROTOCOL (gnutls_session_t session
, int protocol
)
201 static int _proto_priority
[] = { 0, 0 };
202 _proto_priority
[0] = protocol
;
204 gnutls_protocol_set_priority (session
, _proto_priority
);
208 ADD_PROTOCOL3 (gnutls_session_t session
, int p1
, int p2
, int p3
)
210 static int _proto_priority
[] = { 0, 0, 0, 0 };
211 _proto_priority
[0] = p1
;
212 _proto_priority
[1] = p2
;
213 _proto_priority
[2] = p3
;
215 gnutls_protocol_set_priority (session
, _proto_priority
);
219 static int srp_detected
;
222 _test_srp_username_callback (gnutls_session_t session
,
223 char **username
, char **password
)
231 test_srp (gnutls_session_t session
)
235 ADD_ALL_CIPHERS (session
);
236 ADD_ALL_COMP (session
);
237 ADD_ALL_CERTTYPES (session
);
238 ADD_ALL_PROTOCOLS (session
);
239 ADD_ALL_MACS (session
);
241 ADD_KX (session
, GNUTLS_KX_SRP
);
244 gnutls_srp_set_client_credentials_function (srp_cred
,
245 _test_srp_username_callback
);
247 gnutls_credentials_set (session
, GNUTLS_CRD_SRP
, srp_cred
);
249 ret
= do_handshake (session
);
251 gnutls_srp_set_client_credentials_function (srp_cred
, NULL
);
253 if (srp_detected
!= 0)
261 test_server (gnutls_session_t session
)
266 const char snd_buf
[] = "GET / HTTP/1.0\n\n";
271 buf
[sizeof (buf
) - 1] = 0;
273 ADD_ALL_CIPHERS (session
);
274 ADD_ALL_COMP (session
);
275 ADD_ALL_CERTTYPES (session
);
276 ADD_ALL_PROTOCOLS (session
);
277 ADD_ALL_MACS (session
);
278 ADD_ALL_KX (session
);
280 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
282 ret
= do_handshake (session
);
283 if (ret
!= TEST_SUCCEED
)
286 gnutls_record_send (session
, snd_buf
, sizeof (snd_buf
) - 1);
287 ret
= gnutls_record_recv (session
, buf
, sizeof (buf
) - 1);
291 p
= strstr (buf
, "Server:");
297 while (*p
!= 0 && *p
!= '\r' && *p
!= '\n')
311 static int export_true
= 0;
312 static gnutls_datum_t exp
= { NULL
, 0 }, mod
=
318 test_export (gnutls_session_t session
)
322 ADD_ALL_COMP (session
);
323 ADD_ALL_CERTTYPES (session
);
324 ADD_ALL_PROTOCOLS (session
);
325 ADD_ALL_MACS (session
);
327 ADD_KX (session
, GNUTLS_KX_RSA_EXPORT
);
328 ADD_CIPHER (session
, GNUTLS_CIPHER_ARCFOUR_40
);
329 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
331 ret
= do_handshake (session
);
333 if (ret
== TEST_SUCCEED
)
336 gnutls_rsa_export_get_pubkey (session
, &exp
, &mod
);
343 test_export_info (gnutls_session_t session
)
346 gnutls_datum_t exp2
, mod2
;
349 if (verbose
== 0 || export_true
== 0)
352 ADD_ALL_COMP (session
);
353 ADD_ALL_CERTTYPES (session
);
354 ADD_ALL_PROTOCOLS (session
);
355 ADD_ALL_MACS (session
);
357 ADD_KX (session
, GNUTLS_KX_RSA_EXPORT
);
358 ADD_CIPHER (session
, GNUTLS_CIPHER_ARCFOUR_40
);
359 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
361 ret
= do_handshake (session
);
363 if (ret
== TEST_SUCCEED
)
365 ret2
= gnutls_rsa_export_get_pubkey (session
, &exp2
, &mod2
);
370 print
= raw_to_string (exp2
.data
, exp2
.size
);
372 printf (" Exponent [%d bits]: %s\n", exp2
.size
* 8, print
);
374 print
= raw_to_string (mod2
.data
, mod2
.size
);
376 printf (" Modulus [%d bits]: %s\n", mod2
.size
* 8, print
);
378 if (mod2
.size
!= mod
.size
|| exp2
.size
!= exp
.size
||
379 memcmp (mod2
.data
, mod
.data
, mod
.size
) != 0 ||
380 memcmp (exp2
.data
, exp
.data
, exp
.size
) != 0)
383 (" (server uses different public keys per connection)\n");
392 static gnutls_datum_t pubkey
= { NULL
, 0 };
395 test_dhe (gnutls_session_t session
)
399 ADD_ALL_CIPHERS (session
);
400 ADD_ALL_COMP (session
);
401 ADD_ALL_CERTTYPES (session
);
402 ADD_ALL_PROTOCOLS (session
);
403 ADD_ALL_MACS (session
);
405 ADD_KX2 (session
, GNUTLS_KX_DHE_RSA
, GNUTLS_KX_DHE_DSS
);
406 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
408 ret
= do_handshake (session
);
410 gnutls_dh_get_pubkey (session
, &pubkey
);
416 test_dhe_group (gnutls_session_t session
)
419 gnutls_datum_t gen
, prime
, pubkey2
;
422 if (verbose
== 0 || pubkey
.data
== NULL
)
425 ADD_ALL_CIPHERS (session
);
426 ADD_ALL_COMP (session
);
427 ADD_ALL_CERTTYPES (session
);
428 ADD_ALL_PROTOCOLS (session
);
429 ADD_ALL_MACS (session
);
431 ADD_KX2 (session
, GNUTLS_KX_DHE_RSA
, GNUTLS_KX_DHE_DSS
);
432 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
434 ret
= do_handshake (session
);
436 ret2
= gnutls_dh_get_group (session
, &gen
, &prime
);
441 print
= raw_to_string (gen
.data
, gen
.size
);
443 printf (" Generator [%d bits]: %s\n", gen
.size
* 8, print
);
445 print
= raw_to_string (prime
.data
, prime
.size
);
447 printf (" Prime [%d bits]: %s\n", prime
.size
* 8, print
);
449 gnutls_dh_get_pubkey (session
, &pubkey2
);
450 print
= raw_to_string (pubkey2
.data
, pubkey2
.size
);
452 printf (" Pubkey [%d bits]: %s\n", pubkey2
.size
* 8, print
);
454 if (pubkey2
.data
&& pubkey2
.size
== pubkey
.size
&&
455 memcmp (pubkey
.data
, pubkey2
.data
, pubkey
.size
) == 0)
457 printf (" (public key seems to be static among sessions)\n");
464 test_ssl3 (gnutls_session_t session
)
467 ADD_ALL_CIPHERS (session
);
468 ADD_ALL_COMP (session
);
469 ADD_ALL_CERTTYPES (session
);
470 ADD_PROTOCOL (session
, GNUTLS_SSL3
);
471 ADD_ALL_MACS (session
);
472 ADD_ALL_KX (session
);
473 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
475 ret
= do_handshake (session
);
476 if (ret
== TEST_SUCCEED
)
490 test_bye (gnutls_session_t session
)
497 signal (SIGALRM
, got_alarm
);
500 ADD_ALL_CIPHERS (session
);
501 ADD_ALL_COMP (session
);
502 ADD_ALL_CERTTYPES (session
);
503 ADD_ALL_PROTOCOLS (session
);
504 ADD_ALL_MACS (session
);
505 ADD_ALL_KX (session
);
506 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
508 ret
= do_handshake (session
);
509 if (ret
== TEST_FAILED
)
512 ret
= gnutls_bye (session
, GNUTLS_SHUT_WR
);
517 old
= siginterrupt (SIGALRM
, 1);
520 setsockopt ((int) gnutls_transport_get_ptr (session
), SOL_SOCKET
,
521 SO_RCVTIMEO
, (char *) &secs
, sizeof (int));
526 ret
= gnutls_record_recv (session
, data
, sizeof (data
));
531 siginterrupt (SIGALRM
, old
);
533 if (WSAGetLastError () == WSAETIMEDOUT
||
534 WSAGetLastError () == WSAECONNABORTED
)
549 test_aes (gnutls_session_t session
)
552 ADD_CIPHER (session
, GNUTLS_CIPHER_AES_128_CBC
);
553 ADD_ALL_COMP (session
);
554 ADD_ALL_CERTTYPES (session
);
555 ADD_ALL_PROTOCOLS (session
);
556 ADD_ALL_MACS (session
);
557 ADD_ALL_KX (session
);
558 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
560 ret
= do_handshake (session
);
564 #ifdef ENABLE_CAMELLIA
566 test_camellia (gnutls_session_t session
)
569 ADD_CIPHER (session
, GNUTLS_CIPHER_CAMELLIA_128_CBC
);
570 ADD_ALL_COMP (session
);
571 ADD_ALL_CERTTYPES (session
);
572 ADD_ALL_PROTOCOLS (session
);
573 ADD_ALL_MACS (session
);
574 ADD_ALL_KX (session
);
575 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
577 ret
= do_handshake (session
);
583 test_openpgp1 (gnutls_session_t session
)
586 ADD_ALL_CIPHERS (session
);
587 ADD_ALL_COMP (session
);
588 ADD_CERTTYPE (session
, GNUTLS_CRT_OPENPGP
);
589 ADD_ALL_PROTOCOLS (session
);
590 ADD_ALL_MACS (session
);
591 ADD_ALL_KX (session
);
592 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
594 ret
= do_handshake (session
);
595 if (ret
== TEST_FAILED
)
598 if (gnutls_certificate_type_get (session
) == GNUTLS_CRT_OPENPGP
)
605 test_unknown_ciphersuites (gnutls_session_t session
)
608 #ifdef ENABLE_CAMELLIA
609 ADD_CIPHER4 (session
, GNUTLS_CIPHER_AES_128_CBC
, GNUTLS_CIPHER_3DES_CBC
,
610 GNUTLS_CIPHER_CAMELLIA_128_CBC
, GNUTLS_CIPHER_ARCFOUR_128
);
612 ADD_CIPHER4 (session
, GNUTLS_CIPHER_AES_128_CBC
, GNUTLS_CIPHER_3DES_CBC
,
613 GNUTLS_CIPHER_ARCFOUR_128
, 0);
615 ADD_ALL_COMP (session
);
616 ADD_ALL_CERTTYPES (session
);
617 ADD_ALL_PROTOCOLS (session
);
618 ADD_ALL_MACS (session
);
619 ADD_ALL_KX (session
);
620 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
622 ret
= do_handshake (session
);
627 test_md5 (gnutls_session_t session
)
630 ADD_ALL_CIPHERS (session
);
631 ADD_ALL_COMP (session
);
632 ADD_ALL_CERTTYPES (session
);
633 ADD_ALL_PROTOCOLS (session
);
634 ADD_MAC (session
, GNUTLS_MAC_MD5
);
635 ADD_ALL_KX (session
);
636 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
638 ret
= do_handshake (session
);
644 test_zlib (gnutls_session_t session
)
647 ADD_ALL_CIPHERS (session
);
648 ADD_COMP (session
, GNUTLS_COMP_ZLIB
);
649 ADD_ALL_CERTTYPES (session
);
650 ADD_ALL_PROTOCOLS (session
);
651 ADD_ALL_MACS (session
);
652 ADD_ALL_KX (session
);
653 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
655 ret
= do_handshake (session
);
661 test_lzo (gnutls_session_t session
)
664 gnutls_handshake_set_private_extensions (session
, 1);
666 ADD_ALL_CIPHERS (session
);
667 ADD_COMP (session
, GNUTLS_COMP_LZO
);
668 ADD_ALL_CERTTYPES (session
);
669 ADD_ALL_PROTOCOLS (session
);
670 ADD_ALL_MACS (session
);
671 ADD_ALL_KX (session
);
672 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
674 ret
= do_handshake (session
);
680 test_sha (gnutls_session_t session
)
683 ADD_ALL_CIPHERS (session
);
684 ADD_ALL_COMP (session
);
685 ADD_ALL_CERTTYPES (session
);
686 ADD_ALL_PROTOCOLS (session
);
687 ADD_MAC (session
, GNUTLS_MAC_SHA1
);
688 ADD_ALL_KX (session
);
689 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
691 ret
= do_handshake (session
);
696 test_3des (gnutls_session_t session
)
699 ADD_CIPHER (session
, GNUTLS_CIPHER_3DES_CBC
);
700 ADD_ALL_COMP (session
);
701 ADD_ALL_CERTTYPES (session
);
702 ADD_ALL_PROTOCOLS (session
);
703 ADD_ALL_MACS (session
);
704 ADD_ALL_KX (session
);
705 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
707 ret
= do_handshake (session
);
712 test_arcfour (gnutls_session_t session
)
715 ADD_CIPHER (session
, GNUTLS_CIPHER_ARCFOUR_128
);
716 ADD_ALL_COMP (session
);
717 ADD_ALL_CERTTYPES (session
);
718 ADD_ALL_PROTOCOLS (session
);
719 ADD_ALL_MACS (session
);
720 ADD_ALL_KX (session
);
721 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
723 ret
= do_handshake (session
);
728 test_arcfour_40 (gnutls_session_t session
)
731 ADD_CIPHER (session
, GNUTLS_CIPHER_ARCFOUR_40
);
732 ADD_ALL_COMP (session
);
733 ADD_ALL_CERTTYPES (session
);
734 ADD_ALL_PROTOCOLS (session
);
735 ADD_ALL_MACS (session
);
736 ADD_ALL_KX (session
);
737 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
739 ret
= do_handshake (session
);
744 test_tls1 (gnutls_session_t session
)
747 ADD_ALL_CIPHERS (session
);
748 ADD_ALL_COMP (session
);
749 ADD_ALL_CERTTYPES (session
);
750 ADD_PROTOCOL (session
, GNUTLS_TLS1
);
751 ADD_ALL_MACS (session
);
752 ADD_ALL_KX (session
);
753 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
755 ret
= do_handshake (session
);
756 if (ret
== TEST_SUCCEED
)
764 test_tls1_1 (gnutls_session_t session
)
767 ADD_ALL_CIPHERS (session
);
768 ADD_ALL_COMP (session
);
769 ADD_ALL_CERTTYPES (session
);
770 ADD_PROTOCOL (session
, GNUTLS_TLS1_1
);
771 ADD_ALL_MACS (session
);
772 ADD_ALL_KX (session
);
773 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
775 ret
= do_handshake (session
);
776 if (ret
== TEST_SUCCEED
)
784 test_tls1_1_fallback (gnutls_session_t session
)
790 ADD_ALL_CIPHERS (session
);
791 ADD_ALL_COMP (session
);
792 ADD_ALL_CERTTYPES (session
);
793 ADD_PROTOCOL3 (session
, GNUTLS_TLS1_1
, GNUTLS_TLS1
, GNUTLS_SSL3
);
794 ADD_ALL_MACS (session
);
795 ADD_ALL_KX (session
);
796 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
798 ret
= do_handshake (session
);
799 if (ret
!= TEST_SUCCEED
)
802 if (gnutls_protocol_get_version (session
) == GNUTLS_TLS1
)
804 else if (gnutls_protocol_get_version (session
) == GNUTLS_SSL3
)
811 /* Advertize both TLS 1.0 and SSL 3.0. If the connection fails,
812 * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
815 test_tls_disable (gnutls_session_t session
)
821 ADD_ALL_CIPHERS (session
);
822 ADD_ALL_COMP (session
);
823 ADD_ALL_CERTTYPES (session
);
824 ADD_ALL_PROTOCOLS (session
);
825 ADD_ALL_MACS (session
);
826 ADD_ALL_KX (session
);
827 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
829 ret
= do_handshake (session
);
830 if (ret
== TEST_FAILED
)
832 /* disable TLS 1.0 */
835 protocol_priority
[0] = GNUTLS_SSL3
;
836 protocol_priority
[1] = 0;
844 test_rsa_pms (gnutls_session_t session
)
848 /* here we enable both SSL 3.0 and TLS 1.0
849 * and try to connect and use rsa authentication.
850 * If the server is old, buggy and only supports
851 * SSL 3.0 then the handshake will fail.
853 ADD_ALL_CIPHERS (session
);
854 ADD_ALL_COMP (session
);
855 ADD_ALL_CERTTYPES (session
);
856 ADD_ALL_PROTOCOLS (session
);
857 ADD_ALL_MACS (session
);
858 ADD_KX (session
, GNUTLS_KX_RSA
);
859 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
861 ret
= do_handshake (session
);
862 if (ret
== TEST_FAILED
)
865 if (gnutls_protocol_get_version (session
) == GNUTLS_TLS1
)
871 test_max_record_size (gnutls_session_t session
)
874 ADD_ALL_CIPHERS (session
);
875 ADD_ALL_COMP (session
);
876 ADD_ALL_CERTTYPES (session
);
877 ADD_ALL_PROTOCOLS (session
);
878 ADD_ALL_MACS (session
);
879 ADD_ALL_KX (session
);
880 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
881 gnutls_record_set_max_size (session
, 512);
883 ret
= do_handshake (session
);
884 if (ret
== TEST_FAILED
)
887 ret
= gnutls_record_get_max_size (session
);
895 test_hello_extension (gnutls_session_t session
)
898 ADD_ALL_CIPHERS (session
);
899 ADD_ALL_COMP (session
);
900 ADD_ALL_CERTTYPES (session
);
901 ADD_ALL_PROTOCOLS (session
);
902 ADD_ALL_MACS (session
);
903 ADD_ALL_KX (session
);
904 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
905 gnutls_record_set_max_size (session
, 512);
907 ret
= do_handshake (session
);
911 void _gnutls_record_set_default_version (gnutls_session_t session
,
913 unsigned char minor
);
916 test_version_rollback (gnutls_session_t session
)
922 /* here we enable both SSL 3.0 and TLS 1.0
923 * and we connect using a 3.1 client hello version,
924 * and a 3.0 record version. Some implementations
925 * are buggy (and vulnerable to man in the middle
926 * attacks which allow a version downgrade) and this
927 * connection will fail.
929 ADD_ALL_CIPHERS (session
);
930 ADD_ALL_COMP (session
);
931 ADD_ALL_CERTTYPES (session
);
932 ADD_ALL_PROTOCOLS (session
);
933 ADD_ALL_MACS (session
);
934 ADD_ALL_KX (session
);
935 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
936 _gnutls_record_set_default_version (session
, 3, 0);
938 ret
= do_handshake (session
);
939 if (ret
!= TEST_SUCCEED
)
942 if (tls1_ok
!= 0 && gnutls_protocol_get_version (session
) == GNUTLS_SSL3
)
948 /* See if the server tolerates out of bounds
949 * record layer versions in the first client hello
953 test_version_oob (gnutls_session_t session
)
956 /* here we enable both SSL 3.0 and TLS 1.0
957 * and we connect using a 5.5 record version.
959 ADD_ALL_CIPHERS (session
);
960 ADD_ALL_COMP (session
);
961 ADD_ALL_CERTTYPES (session
);
962 ADD_ALL_PROTOCOLS (session
);
963 ADD_ALL_MACS (session
);
964 ADD_ALL_KX (session
);
965 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
966 _gnutls_record_set_default_version (session
, 5, 5);
968 ret
= do_handshake (session
);
972 void _gnutls_rsa_pms_set_version (gnutls_session_t session
,
973 unsigned char major
, unsigned char minor
);
976 test_rsa_pms_version_check (gnutls_session_t session
)
979 /* here we use an arbitary version in the RSA PMS
980 * to see whether to server will check this version.
982 * A normal server would abort this handshake.
984 ADD_ALL_CIPHERS (session
);
985 ADD_ALL_COMP (session
);
986 ADD_ALL_CERTTYPES (session
);
987 ADD_ALL_PROTOCOLS (session
);
988 ADD_ALL_MACS (session
);
989 ADD_ALL_KX (session
);
990 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
991 _gnutls_rsa_pms_set_version (session
, 5, 5); /* use SSL 5.5 version */
993 ret
= do_handshake (session
);
1000 test_anonymous (gnutls_session_t session
)
1004 ADD_ALL_CIPHERS (session
);
1005 ADD_ALL_COMP (session
);
1006 ADD_ALL_CERTTYPES (session
);
1007 ADD_ALL_PROTOCOLS (session
);
1008 ADD_ALL_MACS (session
);
1009 ADD_KX (session
, GNUTLS_KX_ANON_DH
);
1010 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anon_cred
);
1012 ret
= do_handshake (session
);
1014 if (ret
== TEST_SUCCEED
)
1015 gnutls_dh_get_pubkey (session
, &pubkey
);
1022 test_session_resume2 (gnutls_session_t session
)
1025 char tmp_session_id
[32];
1026 size_t tmp_session_id_size
;
1028 if (session
== NULL
)
1031 ADD_ALL_CIPHERS (session
);
1032 ADD_ALL_COMP (session
);
1033 ADD_ALL_CERTTYPES (session
);
1034 ADD_ALL_PROTOCOLS (session
);
1035 ADD_ALL_MACS (session
);
1036 ADD_ALL_KX (session
);
1038 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
1039 gnutls_credentials_set (session
, GNUTLS_CRD_ANON
, anon_cred
);
1041 gnutls_session_set_data (session
, session_data
, session_data_size
);
1043 memcpy (tmp_session_id
, session_id
, session_id_size
);
1044 tmp_session_id_size
= session_id_size
;
1046 ret
= do_handshake (session
);
1047 if (ret
== TEST_FAILED
)
1050 /* check if we actually resumed the previous session */
1052 session_id_size
= sizeof (session_id
);
1053 gnutls_session_get_id (session
, session_id
, &session_id_size
);
1055 if (session_id_size
== 0)
1058 if (gnutls_session_is_resumed (session
))
1059 return TEST_SUCCEED
;
1061 if (tmp_session_id_size
== session_id_size
&&
1062 memcmp (tmp_session_id
, session_id
, tmp_session_id_size
) == 0)
1063 return TEST_SUCCEED
;
1068 extern char *hostname
;
1071 test_certificate (gnutls_session_t session
)
1078 ADD_ALL_CIPHERS (session
);
1079 ADD_ALL_COMP (session
);
1080 ADD_ALL_CERTTYPES (session
);
1081 ADD_ALL_PROTOCOLS (session
);
1082 ADD_ALL_MACS (session
);
1083 ADD_ALL_KX (session
);
1085 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
1087 ret
= do_handshake (session
);
1088 if (ret
== TEST_FAILED
)
1092 print_cert_info (session
, hostname
, 1);
1094 return TEST_SUCCEED
;
1097 /* A callback function to be used at the certificate selection time.
1100 cert_callback (gnutls_session_t session
,
1101 const gnutls_datum_t
* req_ca_rdn
, int nreqs
,
1102 const gnutls_pk_algorithm_t
* sign_algos
,
1103 int sign_algos_length
, gnutls_retr_st
* st
)
1105 char issuer_dn
[256];
1112 /* Print the server's trusted CAs
1116 printf ("- Server's trusted authorities:\n");
1118 printf ("- Server did not send us any trusted authorities names.\n");
1120 /* print the names (if any) */
1121 for (i
= 0; i
< nreqs
; i
++)
1123 len
= sizeof (issuer_dn
);
1124 ret
= gnutls_x509_rdn_get (&req_ca_rdn
[i
], issuer_dn
, &len
);
1127 printf (" [%d]: ", i
);
1128 printf ("%s\n", issuer_dn
);
1136 /* Prints the trusted server's CAs. This is only
1137 * if the server sends a certificate request packet.
1140 test_server_cas (gnutls_session_t session
)
1147 ADD_ALL_CIPHERS (session
);
1148 ADD_ALL_COMP (session
);
1149 ADD_ALL_CERTTYPES (session
);
1150 ADD_ALL_PROTOCOLS (session
);
1151 ADD_ALL_MACS (session
);
1152 ADD_ALL_KX (session
);
1154 gnutls_credentials_set (session
, GNUTLS_CRD_CERTIFICATE
, xcred
);
1155 gnutls_certificate_client_set_retrieve_function (xcred
, cert_callback
);
1157 ret
= do_handshake (session
);
1158 gnutls_certificate_client_set_retrieve_function (xcred
, NULL
);
1160 if (ret
== TEST_FAILED
)
1162 return TEST_SUCCEED
;