src/tls_test.c

   1 /*
   2  * Copyright (C) 2000-2012 Free Software Foundation, Inc.
   3  *
   4  * This file is part of GnuTLS.
   5  *
   6  * GnuTLS is free software: you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * GnuTLS is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see
  18  * <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include <config.h>
  22 #include <stdio.h>
  23 #include <errno.h>
  24 #include <stdlib.h>
  25 #include <sys/types.h>
  26 #include <string.h>
  27 #include <gnutls/gnutls.h>
  28 #include <sys/time.h>
  29 #if HAVE_SYS_SOCKET_H
  30 # include <sys/socket.h>
  31 #elif HAVE_WS2TCPIP_H
  32 # include <ws2tcpip.h>
  33 #endif
  34 #include <tests.h>
  35 #include <common.h>
  36 #include <cli-debug-args.h>
  37 #include <socket.h>
  38
  39 /* Gnulib portability files. */
  40 #include <progname.h>
  41 #include <version-etc.h>
  42 #include "sockets.h"
  43
  44 static void cmd_parser (int argc, char **argv);
  45
  46 #define ERR(err,s) if (err==-1) {perror(s);return(1);}
  47 #define MAX_BUF 4096
  48
  49 /* global stuff here */
  50 int resume;
  51 const char *hostname = NULL;
  52 int port;
  53 int record_max_size;
  54 int fingerprint;
  55 static int debug = 0;
  56
  57 gnutls_srp_client_credentials_t srp_cred;
  58 gnutls_anon_client_credentials_t anon_cred;
  59 gnutls_certificate_credentials_t xcred;
  60
  61 /* end of global stuff */
  62
  63 unsigned int verbose = 0;
  64
  65 extern int tls1_ok;
  66 extern int tls1_1_ok;
  67 extern int ssl3_ok;
  68
  69 static void
  70 tls_log_func (int level, const char *str)
  71 {
  72   fprintf (stderr, "|<%d>| %s", level, str);
  73 }
  74
  75 typedef test_code_t (*TEST_FUNC) (gnutls_session_t);
  76
  77 typedef struct
  78 {
  79   const char *test_name;
  80   TEST_FUNC func;
  81   const char *suc_str;
  82   const char *fail_str;
  83   const char *unsure_str;
  84 } TLS_TEST;
  85
  86 static const TLS_TEST tls_tests[] = {
  87   {"for SSL 3.0 support", test_ssl3, "yes", "no", "dunno"},
  88   {"whether \%COMPAT is required", test_record_padding, "no", "yes", "dunno"},
  89   {"for TLS 1.0 support", test_tls1, "yes", "no", "dunno"},
  90   {"for TLS 1.1 support", test_tls1_1, "yes", "no", "dunno"},
  91   {"fallback from TLS 1.1 to", test_tls1_1_fallback, "TLS 1.0", "failed",
  92    "SSL 3.0"},
  93   {"for TLS 1.2 support", test_tls1_2, "yes", "no", "dunno"},
  94   /* The following tests will disable TLS 1.x if the server is
  95    * buggy */
  96   {"whether we need to disable TLS 1.2", test_tls_disable2, "no", "yes",
  97    "dunno"},
  98   {"whether we need to disable TLS 1.1", test_tls_disable1, "no", "yes",
  99    "dunno"},
 100   {"whether we need to disable TLS 1.0", test_tls_disable0, "no", "yes",
 101    "dunno"},
 102   {"for Safe renegotiation support", test_safe_renegotiation, "yes", "no",
 103    "dunno"},
 104   {"for Safe renegotiation support (SCSV)", test_safe_renegotiation_scsv,
 105    "yes", "no", "dunno"},
 106   {"for HTTPS server name", test_server, "", "failed", "not checked"},
 107   {"for version rollback bug in RSA PMS", test_rsa_pms, "no", "yes",
 108    "dunno"},
 109   {"for version rollback bug in Client Hello", test_version_rollback,
 110    "no", "yes", "dunno"},
 111
 112
 113   {"whether the server ignores the RSA PMS version",
 114    test_rsa_pms_version_check, "yes", "no", "dunno"},
 115   {"whether the server can accept Hello Extensions",
 116    test_hello_extension, "yes", "no", "dunno"},
 117   {"whether the server can accept HeartBeat Extension", test_heartbeat_extension, "yes", "no", "dunno"},
 118   {"whether the server can accept small records (512 bytes)",
 119    test_small_records, "yes", "no", "dunno"},
 120   {"whether the server can accept cipher suites not in SSL 3.0 spec",
 121    test_unknown_ciphersuites, "yes", "no", "dunno"},
 122   {"whether the server can accept a bogus TLS record version in the client hello", test_version_oob, "yes", "no", "dunno"},
 123   {"for certificate information", test_certificate, "", "", ""},
 124   {"for trusted CAs", test_server_cas, "", "", ""},
 125   {"whether the server understands TLS closure alerts", test_bye, "yes",
 126    "no", "partially"},
 127   /* the fact that is after the closure alert test does matter.
 128    */
 129   {"whether the server supports session resumption",
 130    test_session_resume2, "yes", "no", "dunno"},
 131   {"for export-grade ciphersuite support", test_export, "yes", "no",
 132    "dunno"},
 133   {"RSA-export ciphersuite info", test_export_info, "", "N/A", "N/A"},
 134 #ifdef ENABLE_ANON
 135   {"for anonymous authentication support", test_anonymous, "yes", "no",
 136    "dunno"},
 137   {"anonymous Diffie-Hellman group info", test_dhe_group, "", "N/A",
 138    "N/A"},
 139 #endif
 140   {"for ephemeral Diffie-Hellman support", test_dhe, "yes", "no",
 141    "dunno"},
 142   {"ephemeral Diffie-Hellman group info", test_dhe_group, "", "N/A",
 143    "N/A"},
 144   {"for ephemeral EC Diffie-Hellman support", test_ecdhe, "yes", "no",
 145    "dunno"},
 146   {"ephemeral EC Diffie-Hellman group info", test_ecdhe_curve, "", "N/A",
 147    "N/A"},
 148   {"for AES-GCM cipher support", test_aes_gcm, "yes", "no",
 149    "dunno"},
 150   {"for AES-CBC cipher support", test_aes, "yes", "no",
 151    "dunno"},
 152   {"for CAMELLIA cipher support", test_camellia, "yes", "no",
 153    "dunno"},
 154   {"for 3DES-CBC cipher support", test_3des, "yes", "no", "dunno"},
 155   {"for ARCFOUR 128 cipher support", test_arcfour, "yes", "no", "dunno"},
 156   {"for ARCFOUR 40 cipher support", test_arcfour_40, "yes", "no",
 157    "dunno"},
 158   {"for MD5 MAC support", test_md5, "yes", "no", "dunno"},
 159   {"for SHA1 MAC support", test_sha, "yes", "no", "dunno"},
 160   {"for SHA256 MAC support", test_sha256, "yes", "no", "dunno"},
 161 #ifdef HAVE_LIBZ
 162   {"for ZLIB compression support", test_zlib, "yes",
 163    "no", "dunno"},
 164 #endif
 165   {"for max record size", test_max_record_size, "yes",
 166    "no", "dunno"},
 167   {"for OpenPGP authentication support", test_openpgp1,
 168    "yes", "no", "dunno"},
 169   {NULL, NULL, NULL, NULL, NULL}
 170 };
 171
 172 static int tt = 0;
 173 const char *ip;
 174
 175 int
 176 main (int argc, char **argv)
 177 {
 178   int err, ret;
 179   int sd, i;
 180   gnutls_session_t state;
 181   char buffer[MAX_BUF + 1];
 182   char portname[6];
 183   struct addrinfo hints, *res, *ptr;
 184
 185   set_program_name (argv[0]);
 186   cmd_parser(argc, argv);
 187
 188 #ifndef _WIN32
 189   signal (SIGPIPE, SIG_IGN);
 190 #endif
 191
 192   sockets_init ();
 193
 194   if (gnutls_global_init () < 0)
 195     {
 196       fprintf (stderr, "global state initialization error\n");
 197       exit (1);
 198     }
 199
 200   gnutls_global_set_log_function (tls_log_func);
 201   gnutls_global_set_log_level (debug);
 202
 203   printf ("Resolving '%s'...\n", hostname);
 204   /* get server name */
 205   memset (&hints, 0, sizeof (hints));
 206   hints.ai_socktype = SOCK_STREAM;
 207   hints.ai_flags = 0;
 208   snprintf (portname, sizeof (portname), "%d", port);
 209   if ((err = getaddrinfo (hostname, portname, &hints, &res)) != 0)
 210     {
 211       fprintf (stderr, "Cannot resolve %s: %s\n", hostname,
 212                gai_strerror (err));
 213       exit (1);
 214     }
 215
 216   /* X509 stuff */
 217   if (gnutls_certificate_allocate_credentials (&xcred) < 0)
 218     {                           /* space for 2 certificates */
 219       fprintf (stderr, "memory error\n");
 220       exit (1);
 221     }
 222
 223   /* SRP stuff */
 224 #ifdef ENABLE_SRP
 225   if (gnutls_srp_allocate_client_credentials (&srp_cred) < 0)
 226     {
 227       fprintf (stderr, "memory error\n");
 228       exit (1);
 229     }
 230 #endif
 231
 232 #ifdef ENABLE_ANON
 233   /* ANON stuff */
 234   if (gnutls_anon_allocate_client_credentials (&anon_cred) < 0)
 235     {
 236       fprintf (stderr, "memory error\n");
 237       exit (1);
 238     }
 239 #endif
 240
 241   i = 0;
 242
 243   do
 244     {
 245
 246       if (tls_tests[i].test_name == NULL)
 247         break;                  /* finished */
 248
 249       /* if neither of SSL3 and TLSv1 are supported, exit
 250        */
 251       if (i > 6 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0)
 252         {
 253           fprintf (stderr,
 254                    "\nServer does not support any of SSL 3.0, TLS 1.0 and TLS 1.1\n");
 255           break;
 256         }
 257
 258       sd = -1;
 259       for (ptr = res; ptr != NULL; ptr = ptr->ai_next)
 260         {
 261           sd = socket (ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol);
 262           if (sd == -1)
 263             {
 264               continue;
 265             }
 266
 267           getnameinfo (ptr->ai_addr, ptr->ai_addrlen, buffer, MAX_BUF,
 268                        NULL, 0, NI_NUMERICHOST);
 269           if (tt++ == 0)
 270             printf ("Connecting to '%s:%d'...\n", buffer, port);
 271           if ((err = connect (sd, ptr->ai_addr, ptr->ai_addrlen)) != 0)
 272             {
 273               close (sd);
 274               sd = -1;
 275               continue;
 276             }
 277         }
 278       ERR (err, "connect") gnutls_init (&state, GNUTLS_CLIENT|GNUTLS_NO_EXTENSIONS);
 279       gnutls_transport_set_ptr (state, (gnutls_transport_ptr_t)
 280                                 gl_fd_to_handle (sd));
 281
 282       do
 283         {
 284           printf ("Checking %s...", tls_tests[i].test_name);
 285           fflush(stdout);
 286
 287           ret = tls_tests[i].func (state);
 288
 289           if (ret == TEST_SUCCEED)
 290             printf (" %s\n", tls_tests[i].suc_str);
 291           else if (ret == TEST_FAILED)
 292             printf (" %s\n", tls_tests[i].fail_str);
 293           else if (ret == TEST_UNSURE)
 294             printf (" %s\n", tls_tests[i].unsure_str);
 295           else if (ret == TEST_IGNORE)
 296             {
 297               printf (" N/A\n");
 298               i++;
 299             }
 300         }
 301       while (ret == TEST_IGNORE && tls_tests[i].test_name != NULL);
 302
 303       gnutls_deinit (state);
 304
 305       shutdown (sd, SHUT_RDWR); /* no more receptions */
 306       close (sd);
 307
 308       i++;
 309     }
 310   while (1);
 311
 312   freeaddrinfo (res);
 313
 314 #ifdef ENABLE_SRP
 315   gnutls_srp_free_client_credentials (srp_cred);
 316 #endif
 317   gnutls_certificate_free_credentials (xcred);
 318 #ifdef ENABLE_ANON
 319   gnutls_anon_free_client_credentials (anon_cred);
 320 #endif
 321   gnutls_global_deinit ();
 322
 323   return 0;
 324 }
 325
 326 static void cmd_parser (int argc, char **argv)
 327 {
 328   const char* rest = NULL;
 329   int optct = optionProcess( &gnutls_cli_debugOptions, argc, argv);
 330   argc -= optct;
 331   argv += optct;
 332
 333   if (rest == NULL && argc > 0)
 334     rest = argv[0];
 335
 336   if (HAVE_OPT(PORT))
 337     port = OPT_VALUE_PORT;
 338   else
 339     port = 443;
 340
 341   if (rest == NULL)
 342     hostname = "localhost";
 343   else
 344     hostname = rest;
 345
 346   if (HAVE_OPT(DEBUG))
 347     debug = OPT_VALUE_DEBUG;
 348
 349   if (HAVE_OPT(VERBOSE))
 350     verbose++;
 351
 352 }
 353