src/tests.c

   1 /*
   2  * Copyright (C) 2000-2012 Free Software Foundation, Inc.
   3  *
   4  * This file is part of GnuTLS.
   5  *
   6  * GnuTLS is free software: you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * GnuTLS is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see
  18  * <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include <config.h>
  22 #include <gnutls/gnutls.h>
  23 #include <gnutls/x509.h>
  24
  25 #ifndef _WIN32
  26 #include <unistd.h>
  27 #include <signal.h>
  28 #else
  29 #include <errno.h>
  30 #endif
  31
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include <common.h>
  36 #include <tests.h>
  37
  38 extern gnutls_srp_client_credentials_t srp_cred;
  39 extern gnutls_anon_client_credentials_t anon_cred;
  40 extern gnutls_certificate_credentials_t xcred;
  41
  42 extern int verbose;
  43
  44 int tls1_ok = 0;
  45 int ssl3_ok = 0;
  46 int tls1_1_ok = 0;
  47 int tls1_2_ok = 0;
  48
  49 /* keep session info */
  50 static char *session_data = NULL;
  51 static char session_id[32];
  52 static size_t session_data_size = 0, session_id_size = 0;
  53 static int sfree = 0;
  54 static int handshake_output = 0;
  55
  56 static int
  57 do_handshake (gnutls_session_t session)
  58 {
  59   int ret, alert;
  60
  61   do
  62     {
  63       ret = gnutls_handshake (session);
  64     }
  65   while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN);
  66
  67   handshake_output = ret;
  68
  69   if (ret < 0 && verbose > 1)
  70     {
  71       if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED
  72           || ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
  73         {
  74           alert = gnutls_alert_get (session);
  75           printf ("\n");
  76           printf ("*** Received alert [%d]: %s\n",
  77                   alert, gnutls_alert_get_name (alert));
  78         }
  79     }
  80
  81   if (ret < 0)
  82     return TEST_FAILED;
  83
  84   gnutls_session_get_data (session, NULL, &session_data_size);
  85
  86   if (sfree != 0)
  87     {
  88       free (session_data);
  89       sfree = 0;
  90     }
  91   session_data = malloc (session_data_size);
  92   sfree = 1;
  93   if (session_data == NULL)
  94     {
  95       fprintf (stderr, "Memory error\n");
  96       exit (1);
  97     }
  98   gnutls_session_get_data (session, session_data, &session_data_size);
  99
 100   session_id_size = sizeof (session_id);
 101   gnutls_session_get_id (session, session_id, &session_id_size);
 102
 103   return TEST_SUCCEED;
 104 }
 105
 106 char protocol_str[] = "+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
 107 char protocol_all_str[] = "+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
 108 char prio_str[512] = "";
 109
 110 #define ALL_CIPHERS "+3DES-CBC:+ARCFOUR-128:+ARCFOUR-40"
 111 #define BLOCK_CIPHERS "+3DES-CBC:+AES-128-CBC"
 112 #define ALL_COMP "+COMP-NULL"
 113 #define ALL_MACS "+SHA1:+MD5"
 114 #define ALL_CERTTYPES "+CTYPE-X509"
 115 #define ALL_KX "+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+RSA-EXPORT:+ECDHE-RSA:+ECDHE-ECDSA:+ANON-ECDH"
 116 #define INIT_STR "NONE:"
 117 char rest[128] = "%UNSAFE_RENEGOTIATION:+SIGN-ALL:+CURVE-ALL";
 118
 119 static inline void
 120 _gnutls_priority_set_direct (gnutls_session_t session, const char *str)
 121 {
 122   const char *err;
 123   int ret = gnutls_priority_set_direct (session, str, &err);
 124
 125   if (ret < 0)
 126     {
 127       fprintf (stderr, "Error with string %s\n", str);
 128       fprintf (stderr, "Error at %s: %s\n", err, gnutls_strerror (ret));
 129       exit (1);
 130     }
 131 }
 132
 133 test_code_t
 134 test_server (gnutls_session_t session)
 135 {
 136   int ret, i = 0;
 137   char buf[5 * 1024];
 138   char *p;
 139   const char snd_buf[] = "GET / HTTP/1.0\n\n";
 140
 141   if (verbose == 0)
 142     return TEST_UNSURE;
 143
 144   buf[sizeof (buf) - 1] = 0;
 145
 146   sprintf (prio_str, INIT_STR
 147            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS ":"
 148            ALL_KX ":" "%s", protocol_str, rest);
 149   _gnutls_priority_set_direct (session, prio_str);
 150
 151   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 152
 153   ret = do_handshake (session);
 154   if (ret != TEST_SUCCEED)
 155     return TEST_FAILED;
 156
 157   gnutls_record_send (session, snd_buf, sizeof (snd_buf) - 1);
 158   ret = gnutls_record_recv (session, buf, sizeof (buf) - 1);
 159   if (ret < 0)
 160     return TEST_FAILED;
 161
 162   p = strstr (buf, "Server:");
 163   if (p != NULL)
 164     p = strchr (p, ':');
 165   if (p != NULL)
 166     {
 167       p++;
 168       while (*p != 0 && *p != '\r' && *p != '\n')
 169         {
 170           putc (*p, stdout);
 171           p++;
 172           i++;
 173           if (i > 128)
 174             break;
 175         }
 176     }
 177
 178   return TEST_SUCCEED;
 179 }
 180
 181
 182 static int export_true = 0;
 183 static gnutls_datum_t exp = { NULL, 0 }, mod =
 184
 185 {
 186 NULL, 0};
 187
 188 test_code_t
 189 test_export (gnutls_session_t session)
 190 {
 191   int ret;
 192
 193   sprintf (prio_str, INIT_STR
 194            "+ARCFOUR-40:+RSA-EXPORT:" ALL_COMP ":" ALL_CERTTYPES ":%s:"
 195            ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
 196   _gnutls_priority_set_direct (session, prio_str);
 197
 198   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 199
 200   ret = do_handshake (session);
 201
 202   if (ret == TEST_SUCCEED)
 203     {
 204       export_true = 1;
 205       gnutls_rsa_export_get_pubkey (session, &exp, &mod);
 206     }
 207
 208   return ret;
 209 }
 210
 211 test_code_t
 212 test_export_info (gnutls_session_t session)
 213 {
 214   int ret2, ret;
 215   gnutls_datum_t exp2, mod2;
 216   const char *print;
 217
 218   if (verbose == 0 || export_true == 0)
 219     return TEST_IGNORE;
 220
 221   sprintf (prio_str, INIT_STR
 222            "+ARCFOUR-40:+RSA-EXPORT:" ALL_COMP ":" ALL_CERTTYPES ":%s:"
 223            ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
 224   _gnutls_priority_set_direct (session, prio_str);
 225
 226   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 227
 228   ret = do_handshake (session);
 229
 230   if (ret == TEST_SUCCEED)
 231     {
 232       ret2 = gnutls_rsa_export_get_pubkey (session, &exp2, &mod2);
 233       if (ret2 >= 0)
 234         {
 235           printf ("\n");
 236
 237           print = raw_to_string (exp2.data, exp2.size);
 238           if (print)
 239             printf (" Exponent [%d bits]: %s\n", exp2.size * 8, print);
 240
 241           print = raw_to_string (mod2.data, mod2.size);
 242           if (print)
 243             printf (" Modulus [%d bits]: %s\n", mod2.size * 8, print);
 244
 245           if (mod2.size != mod.size || exp2.size != exp.size ||
 246               memcmp (mod2.data, mod.data, mod.size) != 0 ||
 247               memcmp (exp2.data, exp.data, exp.size) != 0)
 248             {
 249               printf
 250                 (" (server uses different public keys per connection)\n");
 251             }
 252         }
 253     }
 254
 255   return ret;
 256
 257 }
 258
 259 static gnutls_datum_t pubkey = { NULL, 0 };
 260 static gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID;
 261
 262 test_code_t
 263 test_dhe (gnutls_session_t session)
 264 {
 265   int ret;
 266
 267   sprintf (prio_str, INIT_STR
 268            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 269            ":+DHE-RSA:+DHE-DSS:%s", protocol_str, rest);
 270   _gnutls_priority_set_direct (session, prio_str);
 271
 272   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 273
 274   ret = do_handshake (session);
 275
 276   gnutls_dh_get_pubkey (session, &pubkey);
 277
 278   return ret;
 279 }
 280
 281 test_code_t test_ecdhe (gnutls_session_t session)
 282 {
 283   int ret;
 284
 285   sprintf (prio_str, INIT_STR
 286            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 287            ":+ECDHE-RSA:+ECDHE-ECDSA:+CURVE-ALL:%s", protocol_all_str, rest);
 288   _gnutls_priority_set_direct (session, prio_str);
 289
 290   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 291
 292   ret = do_handshake (session);
 293
 294   curve = gnutls_ecc_curve_get(session);
 295
 296   return ret;
 297 }
 298
 299
 300 test_code_t
 301 test_safe_renegotiation (gnutls_session_t session)
 302 {
 303   int ret;
 304
 305   sprintf (prio_str, INIT_STR
 306            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS ":"
 307            ALL_KX ":%%SAFE_RENEGOTIATION", protocol_str);
 308   _gnutls_priority_set_direct (session, prio_str);
 309
 310   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 311
 312   ret = do_handshake (session);
 313
 314   return ret;
 315 }
 316
 317 test_code_t
 318 test_safe_renegotiation_scsv (gnutls_session_t session)
 319 {
 320   int ret;
 321
 322   sprintf (prio_str, INIT_STR
 323            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":+VERS-SSL3.0:"
 324            ALL_MACS ":" ALL_KX ":%%SAFE_RENEGOTIATION");
 325   _gnutls_priority_set_direct (session, prio_str);
 326
 327   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 328
 329   ret = do_handshake (session);
 330
 331   return ret;
 332 }
 333
 334 test_code_t
 335 test_dhe_group (gnutls_session_t session)
 336 {
 337   int ret, ret2;
 338   gnutls_datum_t gen, prime, pubkey2;
 339   const char *print;
 340
 341   if (verbose == 0 || pubkey.data == NULL)
 342     return TEST_IGNORE;
 343
 344   sprintf (prio_str, INIT_STR
 345            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 346            ":+DHE-RSA:+DHE-DSS:%s", protocol_str, rest);
 347
 348   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 349
 350   ret = do_handshake (session);
 351
 352   ret2 = gnutls_dh_get_group (session, &gen, &prime);
 353   if (ret2 >= 0)
 354     {
 355       printf ("\n");
 356
 357       print = raw_to_string (gen.data, gen.size);
 358       if (print)
 359         printf (" Generator [%d bits]: %s\n", gen.size * 8, print);
 360
 361       print = raw_to_string (prime.data, prime.size);
 362       if (print)
 363         printf (" Prime [%d bits]: %s\n", prime.size * 8, print);
 364
 365       gnutls_dh_get_pubkey (session, &pubkey2);
 366       print = raw_to_string (pubkey2.data, pubkey2.size);
 367       if (print)
 368         printf (" Pubkey [%d bits]: %s\n", pubkey2.size * 8, print);
 369
 370       if (pubkey2.data && pubkey2.size == pubkey.size &&
 371           memcmp (pubkey.data, pubkey2.data, pubkey.size) == 0)
 372         {
 373           printf (" (public key seems to be static among sessions)\n");
 374         }
 375     }
 376   return ret;
 377 }
 378
 379 test_code_t
 380 test_ecdhe_curve (gnutls_session_t session)
 381 {
 382   if (curve == GNUTLS_ECC_CURVE_INVALID)
 383     return TEST_IGNORE;
 384
 385   printf ("\n Curve %s", gnutls_ecc_curve_get_name(curve));
 386
 387   return TEST_SUCCEED;
 388 }
 389
 390 test_code_t
 391 test_ssl3 (gnutls_session_t session)
 392 {
 393   int ret;
 394   sprintf (prio_str, INIT_STR
 395            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":+VERS-SSL3.0:"
 396            ALL_MACS ":" ALL_KX ":%s", rest);
 397   _gnutls_priority_set_direct (session, prio_str);
 398
 399   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 400
 401   ret = do_handshake (session);
 402   if (ret == TEST_SUCCEED)
 403     ssl3_ok = 1;
 404
 405   return ret;
 406 }
 407
 408 static int alrm = 0;
 409 static void
 410 got_alarm (int k)
 411 {
 412   alrm = 1;
 413 }
 414
 415 test_code_t
 416 test_bye (gnutls_session_t session)
 417 {
 418   int ret;
 419   char data[20];
 420   int secs = 6;
 421 #ifndef _WIN32
 422   int old;
 423
 424   signal (SIGALRM, got_alarm);
 425 #endif
 426
 427   sprintf (prio_str, INIT_STR
 428            ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS ":"
 429            ALL_KX ":%s", protocol_str, rest);
 430   _gnutls_priority_set_direct (session, prio_str);
 431
 432   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 433
 434   ret = do_handshake (session);
 435   if (ret == TEST_FAILED)
 436     return ret;
 437
 438   ret = gnutls_bye (session, GNUTLS_SHUT_WR);
 439   if (ret < 0)
 440     return TEST_FAILED;
 441
 442 #ifndef _WIN32
 443   old = siginterrupt (SIGALRM, 1);
 444   alarm (secs);
 445 #else
 446   setsockopt ((int) gnutls_transport_get_ptr (session), SOL_SOCKET,
 447               SO_RCVTIMEO, (char *) &secs, sizeof (int));
 448 #endif
 449
 450   do
 451     {
 452       ret = gnutls_record_recv (session, data, sizeof (data));
 453     }
 454   while (ret > 0);
 455
 456 #ifndef _WIN32
 457   siginterrupt (SIGALRM, old);
 458 #else
 459   if (WSAGetLastError () == WSAETIMEDOUT ||
 460       WSAGetLastError () == WSAECONNABORTED)
 461     alrm = 1;
 462 #endif
 463   if (ret == 0)
 464     return TEST_SUCCEED;
 465
 466   if (alrm == 0)
 467     return TEST_UNSURE;
 468
 469   return TEST_FAILED;
 470 }
 471
 472
 473
 474 test_code_t
 475 test_aes (gnutls_session_t session)
 476 {
 477   int ret;
 478
 479   sprintf (prio_str, INIT_STR
 480            "+AES-128-CBC:" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 481            ":" ALL_KX ":%s", protocol_str, rest);
 482   _gnutls_priority_set_direct (session, prio_str);
 483
 484   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 485
 486   ret = do_handshake (session);
 487   return ret;
 488 }
 489
 490 test_code_t test_aes_gcm (gnutls_session_t session)
 491 {
 492   int ret;
 493
 494   sprintf (prio_str, INIT_STR
 495            "+AES-128-GCM:+AES-256-GCM:+AEAD:" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 496            ":" ALL_KX ":%s", protocol_all_str, rest);
 497   _gnutls_priority_set_direct (session, prio_str);
 498
 499   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 500
 501   ret = do_handshake (session);
 502   return ret;
 503 }
 504
 505 test_code_t
 506 test_camellia (gnutls_session_t session)
 507 {
 508   int ret;
 509
 510   sprintf (prio_str,
 511            INIT_STR "+CAMELLIA-128-CBC:" ALL_COMP ":" ALL_CERTTYPES ":%s:"
 512            ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
 513   _gnutls_priority_set_direct (session, prio_str);
 514
 515   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 516
 517   ret = do_handshake (session);
 518   return ret;
 519 }
 520
 521 test_code_t
 522 test_openpgp1 (gnutls_session_t session)
 523 {
 524   int ret;
 525
 526   sprintf (prio_str,
 527            INIT_STR ALL_CIPHERS ":" ALL_COMP ":+CTYPE-OPENPGP:%s:" ALL_MACS
 528            ":" ALL_KX ":%s", protocol_str, rest);
 529   _gnutls_priority_set_direct (session, prio_str);
 530
 531   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 532
 533   ret = do_handshake (session);
 534   if (ret == TEST_FAILED)
 535     return ret;
 536
 537   if (gnutls_certificate_type_get (session) == GNUTLS_CRT_OPENPGP)
 538     return TEST_SUCCEED;
 539
 540   return TEST_FAILED;
 541 }
 542
 543 test_code_t
 544 test_unknown_ciphersuites (gnutls_session_t session)
 545 {
 546   int ret;
 547
 548   sprintf (prio_str,
 549            INIT_STR "+AES-128-CBC:" ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 550            ":%s:" ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
 551   _gnutls_priority_set_direct (session, prio_str);
 552
 553   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 554
 555   ret = do_handshake (session);
 556   return ret;
 557 }
 558
 559 test_code_t
 560 test_md5 (gnutls_session_t session)
 561 {
 562   int ret;
 563
 564   sprintf (prio_str,
 565            INIT_STR "+AES-128-CBC:" ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 566            ":%s:+MD5:" ALL_KX ":%s", protocol_str, rest);
 567   _gnutls_priority_set_direct (session, prio_str);
 568
 569   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 570
 571   ret = do_handshake (session);
 572   return ret;
 573 }
 574
 575 #ifdef HAVE_LIBZ
 576 test_code_t
 577 test_zlib (gnutls_session_t session)
 578 {
 579   int ret;
 580
 581   sprintf (prio_str,
 582            INIT_STR ALL_CIPHERS ":+COMP-DEFLATE:" ALL_CERTTYPES ":%s:" ALL_MACS
 583            ":" ALL_KX ":%s", protocol_str, rest);
 584   _gnutls_priority_set_direct (session, prio_str);
 585
 586   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 587
 588   ret = do_handshake (session);
 589   return ret;
 590 }
 591 #endif
 592
 593 test_code_t
 594 test_sha (gnutls_session_t session)
 595 {
 596   int ret;
 597
 598   sprintf (prio_str,
 599            INIT_STR "+AES-128-CBC:" ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 600            ":%s:+SHA1:" ALL_KX ":%s", protocol_str, rest);
 601   _gnutls_priority_set_direct (session, prio_str);
 602   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 603
 604   ret = do_handshake (session);
 605   return ret;
 606 }
 607
 608 test_code_t
 609 test_sha256 (gnutls_session_t session)
 610 {
 611   int ret;
 612
 613   sprintf (prio_str,
 614            INIT_STR "+AES-128-CBC:" ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 615            ":%s:+SHA256:" ALL_KX ":%s", protocol_all_str, rest);
 616   _gnutls_priority_set_direct (session, prio_str);
 617   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 618
 619   ret = do_handshake (session);
 620   return ret;
 621 }
 622
 623 test_code_t
 624 test_3des (gnutls_session_t session)
 625 {
 626   int ret;
 627
 628   sprintf (prio_str,
 629            INIT_STR "+3DES-CBC:" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 630            ":" ALL_KX ":%s", protocol_str, rest);
 631   _gnutls_priority_set_direct (session, prio_str);
 632   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 633
 634   ret = do_handshake (session);
 635   return ret;
 636 }
 637
 638 test_code_t
 639 test_arcfour (gnutls_session_t session)
 640 {
 641   int ret;
 642
 643   sprintf (prio_str,
 644            INIT_STR "+ARCFOUR-128:" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 645            ":" ALL_KX ":%s", protocol_str, rest);
 646   _gnutls_priority_set_direct (session, prio_str);
 647   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 648
 649   ret = do_handshake (session);
 650   return ret;
 651 }
 652
 653 test_code_t
 654 test_arcfour_40 (gnutls_session_t session)
 655 {
 656   int ret;
 657
 658   sprintf (prio_str,
 659            INIT_STR "+ARCFOUR-40:" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 660            ":" "+RSA-EXPORT" ":%s", protocol_str, rest);
 661   _gnutls_priority_set_direct (session, prio_str);
 662
 663   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 664
 665   ret = do_handshake (session);
 666   return ret;
 667 }
 668
 669 test_code_t
 670 test_tls1 (gnutls_session_t session)
 671 {
 672   int ret;
 673
 674   sprintf (prio_str,
 675            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 676            ":+VERS-TLS1.0:" ALL_MACS ":" ALL_KX ":%s", rest);
 677   _gnutls_priority_set_direct (session, prio_str);
 678
 679   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 680
 681   ret = do_handshake (session);
 682   if (ret == TEST_SUCCEED)
 683     tls1_ok = 1;
 684
 685   return ret;
 686
 687 }
 688
 689 test_code_t
 690 test_record_padding (gnutls_session_t session)
 691 {
 692   int ret;
 693
 694   sprintf (prio_str,
 695            INIT_STR BLOCK_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 696            ":+VERS-TLS1.0:" ALL_MACS ":" ALL_KX ":%s", rest);
 697   _gnutls_priority_set_direct (session, prio_str);
 698
 699   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 700   ret = do_handshake (session);
 701   if (ret == TEST_SUCCEED)
 702     {
 703       tls1_ok = 1;
 704     }
 705   else
 706     {
 707       strcat (rest, ":%COMPAT");
 708     }
 709
 710   return ret;
 711 }
 712
 713 test_code_t
 714 test_tls1_2 (gnutls_session_t session)
 715 {
 716   int ret;
 717
 718   sprintf (prio_str,
 719            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 720            ":+VERS-TLS1.2:" ALL_MACS ":" ALL_KX ":%s", rest);
 721   _gnutls_priority_set_direct (session, prio_str);
 722
 723   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 724
 725   ret = do_handshake (session);
 726   if (ret == TEST_SUCCEED)
 727     tls1_2_ok = 1;
 728
 729   return ret;
 730
 731 }
 732
 733 test_code_t
 734 test_tls1_1 (gnutls_session_t session)
 735 {
 736   int ret;
 737
 738   sprintf (prio_str,
 739            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 740            ":+VERS-TLS1.1:" ALL_MACS ":" ALL_KX ":%s", rest);
 741   _gnutls_priority_set_direct (session, prio_str);
 742
 743   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 744
 745   ret = do_handshake (session);
 746   if (ret == TEST_SUCCEED)
 747     tls1_1_ok = 1;
 748
 749   return ret;
 750
 751 }
 752
 753 test_code_t
 754 test_tls1_1_fallback (gnutls_session_t session)
 755 {
 756   int ret;
 757   if (tls1_1_ok)
 758     return TEST_IGNORE;
 759
 760   sprintf (prio_str,
 761            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
 762            ":+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:" ALL_MACS ":" ALL_KX
 763            ":%s", rest);
 764   _gnutls_priority_set_direct (session, prio_str);
 765
 766   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 767
 768   ret = do_handshake (session);
 769   if (ret != TEST_SUCCEED)
 770     return TEST_FAILED;
 771
 772   if (gnutls_protocol_get_version (session) == GNUTLS_TLS1)
 773     return TEST_SUCCEED;
 774   else if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
 775     return TEST_UNSURE;
 776
 777   return TEST_FAILED;
 778
 779 }
 780
 781 /* Advertize both TLS 1.0 and SSL 3.0. If the connection fails,
 782  * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
 783  */
 784 test_code_t
 785 test_tls_disable0 (gnutls_session_t session)
 786 {
 787   int ret;
 788   if (tls1_ok != 0)
 789     return TEST_IGNORE;
 790
 791   sprintf (prio_str,
 792            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 793            ":" ALL_KX ":%s", protocol_str, rest);
 794   _gnutls_priority_set_direct (session, prio_str);
 795
 796   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 797
 798   ret = do_handshake (session);
 799   if (ret == TEST_FAILED)
 800     {
 801       /* disable TLS 1.0 */
 802       if (ssl3_ok != 0)
 803         {
 804           strcpy (protocol_str, "+VERS-SSL3.0");
 805         }
 806     }
 807   return ret;
 808
 809 }
 810
 811 test_code_t
 812 test_tls_disable1 (gnutls_session_t session)
 813 {
 814   int ret;
 815
 816   if (tls1_1_ok != 0)
 817     return TEST_IGNORE;
 818
 819   sprintf (prio_str,
 820            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 821            ":" ALL_KX ":%s", protocol_str, rest);
 822   _gnutls_priority_set_direct (session, prio_str);
 823
 824   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 825
 826   ret = do_handshake (session);
 827   if (ret == TEST_FAILED)
 828     {
 829       protocol_str[0] = 0;
 830       /* disable TLS 1.1 */
 831       if (tls1_ok != 0)
 832         {
 833           strcat (protocol_str, "+VERS-TLS1.0");
 834         }
 835       if (ssl3_ok != 0)
 836         {
 837           if (protocol_str[0] != 0)
 838             strcat (protocol_str, ":+VERS-SSL3.0");
 839           else
 840             strcat (protocol_str, "+VERS-SSL3.0");
 841         }
 842     }
 843   return ret;
 844 }
 845
 846 test_code_t
 847 test_tls_disable2 (gnutls_session_t session)
 848 {
 849   int ret;
 850
 851   if (tls1_2_ok != 0)
 852     return TEST_IGNORE;
 853
 854   sprintf (prio_str,
 855            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 856            ":" ALL_KX ":%s", protocol_str, rest);
 857   _gnutls_priority_set_direct (session, prio_str);
 858
 859   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 860
 861   ret = do_handshake (session);
 862   if (ret == TEST_FAILED)
 863     {
 864       /* disable TLS 1.2 */
 865       protocol_str[0] = 0;
 866       if (tls1_1_ok != 0)
 867         {
 868           strcat (protocol_str, "+VERS-TLS1.1");
 869         }
 870       if (tls1_ok != 0)
 871         {
 872           if (protocol_str[0] != 0)
 873             strcat (protocol_str, ":+VERS-TLS1.0");
 874           else
 875             strcat (protocol_str, "+VERS-TLS1.0");
 876         }
 877       if (ssl3_ok != 0)
 878         {
 879           if (protocol_str[0] != 0)
 880             strcat (protocol_str, ":+VERS-SSL3.0");
 881           else
 882             strcat (protocol_str, "+VERS-SSL3.0");
 883         }
 884     }
 885   return ret;
 886 }
 887
 888
 889 test_code_t
 890 test_rsa_pms (gnutls_session_t session)
 891 {
 892   int ret;
 893
 894   /* here we enable both SSL 3.0 and TLS 1.0
 895    * and try to connect and use rsa authentication.
 896    * If the server is old, buggy and only supports
 897    * SSL 3.0 then the handshake will fail.
 898    */
 899   sprintf (prio_str,
 900            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 901            ":+RSA:%s", protocol_str, rest);
 902   _gnutls_priority_set_direct (session, prio_str);
 903   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 904
 905   ret = do_handshake (session);
 906   if (ret == TEST_FAILED)
 907     return TEST_FAILED;
 908
 909   if (gnutls_protocol_get_version (session) == GNUTLS_TLS1)
 910     return TEST_SUCCEED;
 911   return TEST_UNSURE;
 912 }
 913
 914 test_code_t
 915 test_max_record_size (gnutls_session_t session)
 916 {
 917   int ret;
 918   sprintf (prio_str,
 919            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 920            ":" ALL_KX ":%s", protocol_str, rest);
 921   _gnutls_priority_set_direct (session, prio_str);
 922   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 923   gnutls_record_set_max_size (session, 512);
 924
 925   ret = do_handshake (session);
 926   if (ret == TEST_FAILED)
 927     return ret;
 928
 929   ret = gnutls_record_get_max_size (session);
 930   if (ret == 512)
 931     return TEST_SUCCEED;
 932
 933   return TEST_FAILED;
 934 }
 935
 936 test_code_t
 937 test_hello_extension (gnutls_session_t session)
 938 {
 939   int ret;
 940
 941   sprintf (prio_str,
 942            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 943            ":" ALL_KX ":%s", protocol_str, rest);
 944   _gnutls_priority_set_direct (session, prio_str);
 945   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 946   gnutls_record_set_max_size (session, 4096);
 947
 948   ret = do_handshake (session);
 949
 950
 951   return ret;
 952 }
 953
 954 test_code_t
 955 test_heartbeat_extension (gnutls_session_t session)
 956 {
 957   sprintf (prio_str,
 958            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 959            ":" ALL_KX ":%s", protocol_str, rest);
 960   _gnutls_priority_set_direct (session, prio_str);
 961   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 962   gnutls_record_set_max_size (session, 4096);
 963
 964   gnutls_heartbeat_enable (session, GNUTLS_HB_PEER_ALLOWED_TO_SEND);
 965   do_handshake (session);
 966
 967   switch (gnutls_heartbeat_allowed (session, 1)) {
 968     case 1: return TEST_SUCCEED;
 969     case 0: return TEST_FAILED;
 970     default: return TEST_UNSURE;
 971   }
 972 }
 973
 974 test_code_t
 975 test_small_records (gnutls_session_t session)
 976 {
 977   int ret;
 978
 979   sprintf (prio_str,
 980            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
 981            ":" ALL_KX ":%s", protocol_str, rest);
 982   _gnutls_priority_set_direct (session, prio_str);
 983   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 984   gnutls_record_set_max_size (session, 512);
 985
 986   ret = do_handshake (session);
 987   return ret;
 988 }
 989
 990 void _gnutls_record_set_default_version (gnutls_session_t session,
 991                                          unsigned char major,
 992                                          unsigned char minor);
 993
 994 test_code_t
 995 test_version_rollback (gnutls_session_t session)
 996 {
 997   int ret;
 998   if (tls1_ok == 0)
 999     return TEST_IGNORE;
1000
1001   /* here we enable both SSL 3.0 and TLS 1.0
1002    * and we connect using a 3.1 client hello version,
1003    * and a 3.0 record version. Some implementations
1004    * are buggy (and vulnerable to man in the middle
1005    * attacks which allow a version downgrade) and this
1006    * connection will fail.
1007    */
1008   sprintf (prio_str,
1009            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1010            ":" ALL_KX ":%s", protocol_str, rest);
1011   _gnutls_priority_set_direct (session, prio_str);
1012   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1013   _gnutls_record_set_default_version (session, 3, 0);
1014
1015   ret = do_handshake (session);
1016   if (ret != TEST_SUCCEED)
1017     return ret;
1018
1019   if (tls1_ok != 0 && gnutls_protocol_get_version (session) == GNUTLS_SSL3)
1020     return TEST_FAILED;
1021
1022   return TEST_SUCCEED;
1023 }
1024
1025 /* See if the server tolerates out of bounds
1026  * record layer versions in the first client hello
1027  * message.
1028  */
1029 test_code_t
1030 test_version_oob (gnutls_session_t session)
1031 {
1032   int ret;
1033   /* here we enable both SSL 3.0 and TLS 1.0
1034    * and we connect using a 5.5 record version.
1035    */
1036   sprintf (prio_str,
1037            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1038            ":" ALL_KX ":%s", protocol_str, rest);
1039   _gnutls_priority_set_direct (session, prio_str);
1040   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1041   _gnutls_record_set_default_version (session, 5, 5);
1042
1043   ret = do_handshake (session);
1044   return ret;
1045 }
1046
1047 void _gnutls_rsa_pms_set_version (gnutls_session_t session,
1048                                   unsigned char major, unsigned char minor);
1049
1050 test_code_t
1051 test_rsa_pms_version_check (gnutls_session_t session)
1052 {
1053   int ret;
1054   /* here we use an arbitary version in the RSA PMS
1055    * to see whether to server will check this version.
1056    *
1057    * A normal server would abort this handshake.
1058    */
1059   sprintf (prio_str,
1060            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1061            ":" ALL_KX ":%s", protocol_str, rest);
1062   _gnutls_priority_set_direct (session, prio_str);
1063   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1064   _gnutls_rsa_pms_set_version (session, 5, 5);  /* use SSL 5.5 version */
1065
1066   ret = do_handshake (session);
1067   return ret;
1068
1069 }
1070
1071 #ifdef ENABLE_ANON
1072 test_code_t
1073 test_anonymous (gnutls_session_t session)
1074 {
1075   int ret;
1076
1077   sprintf (prio_str,
1078            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1079            ":+ANON-DH:+ANON-ECDH:+CURVE-ALL:%s", protocol_str, rest);
1080   _gnutls_priority_set_direct (session, prio_str);
1081   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred);
1082
1083   ret = do_handshake (session);
1084
1085   if (ret == TEST_SUCCEED)
1086     gnutls_dh_get_pubkey (session, &pubkey);
1087
1088   return ret;
1089 }
1090 #endif
1091
1092 test_code_t
1093 test_session_resume2 (gnutls_session_t session)
1094 {
1095   int ret;
1096   char tmp_session_id[32];
1097   size_t tmp_session_id_size;
1098
1099   if (session == NULL)
1100     return TEST_IGNORE;
1101
1102   sprintf (prio_str,
1103            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1104            ":" ALL_KX ":%s", protocol_str, rest);
1105   _gnutls_priority_set_direct (session, prio_str);
1106
1107   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1108   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred);
1109
1110   gnutls_session_set_data (session, session_data, session_data_size);
1111
1112   memcpy (tmp_session_id, session_id, session_id_size);
1113   tmp_session_id_size = session_id_size;
1114
1115   ret = do_handshake (session);
1116   if (ret == TEST_FAILED)
1117     return ret;
1118
1119   /* check if we actually resumed the previous session */
1120
1121   session_id_size = sizeof (session_id);
1122   gnutls_session_get_id (session, session_id, &session_id_size);
1123
1124   if (session_id_size == 0)
1125     return TEST_FAILED;
1126
1127   if (gnutls_session_is_resumed (session))
1128     return TEST_SUCCEED;
1129
1130   if (tmp_session_id_size == session_id_size &&
1131       memcmp (tmp_session_id, session_id, tmp_session_id_size) == 0)
1132     return TEST_SUCCEED;
1133   else
1134     return TEST_FAILED;
1135 }
1136
1137 extern char *hostname;
1138
1139 test_code_t
1140 test_certificate (gnutls_session_t session)
1141 {
1142   int ret;
1143
1144   if (verbose == 0)
1145     return TEST_IGNORE;
1146
1147   sprintf (prio_str,
1148            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1149            ":" ALL_KX ":%s", protocol_str, rest);
1150   _gnutls_priority_set_direct (session, prio_str);
1151
1152   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1153
1154   ret = do_handshake (session);
1155   if (ret == TEST_FAILED)
1156     return ret;
1157
1158   printf ("\n");
1159   print_cert_info (session, GNUTLS_CRT_PRINT_FULL, verbose);
1160
1161   return TEST_SUCCEED;
1162 }
1163
1164 /* A callback function to be used at the certificate selection time.
1165  */
1166 static int
1167 cert_callback (gnutls_session_t session,
1168                const gnutls_datum_t * req_ca_rdn, int nreqs,
1169                const gnutls_pk_algorithm_t * sign_algos,
1170                int sign_algos_length, gnutls_retr2_st * st)
1171 {
1172   char issuer_dn[256];
1173   int i, ret;
1174   size_t len;
1175
1176   if (verbose == 0)
1177     return -1;
1178
1179   /* Print the server's trusted CAs
1180    */
1181   printf ("\n");
1182   if (nreqs > 0)
1183     printf ("- Server's trusted authorities:\n");
1184   else
1185     printf ("- Server did not send us any trusted authorities names.\n");
1186
1187   /* print the names (if any) */
1188   for (i = 0; i < nreqs; i++)
1189     {
1190       len = sizeof (issuer_dn);
1191       ret = gnutls_x509_rdn_get (&req_ca_rdn[i], issuer_dn, &len);
1192       if (ret >= 0)
1193         {
1194           printf ("   [%d]: ", i);
1195           printf ("%s\n", issuer_dn);
1196         }
1197     }
1198
1199   return -1;
1200
1201 }
1202
1203 /* Prints the trusted server's CAs. This is only
1204  * if the server sends a certificate request packet.
1205  */
1206 test_code_t
1207 test_server_cas (gnutls_session_t session)
1208 {
1209   int ret;
1210
1211   if (verbose == 0)
1212     return TEST_IGNORE;
1213
1214   sprintf (prio_str,
1215            INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES ":%s:" ALL_MACS
1216            ":" ALL_KX ":%s", protocol_str, rest);
1217   _gnutls_priority_set_direct (session, prio_str);
1218
1219   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
1220   gnutls_certificate_set_retrieve_function (xcred, cert_callback);
1221
1222   ret = do_handshake (session);
1223   gnutls_certificate_set_retrieve_function (xcred, NULL);
1224
1225   if (ret == TEST_FAILED)
1226     return ret;
1227   return TEST_SUCCEED;
1228 }