Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.2:Test
gnutls
CVE-2009-3555-1.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2009-3555-1.patch of Package gnutls
Index: gnutls-2.4.1/configure =================================================================== --- gnutls-2.4.1.orig/configure +++ gnutls-2.4.1/configure @@ -46596,7 +46596,7 @@ cat >>confdefs.h <<\_ACEOF _ACEOF -ac_config_files="$ac_config_files Makefile po/Makefile.in doc/Makefile doc/examples/Makefile doc/scripts/Makefile doc/manpages/Makefile doc/reference/Makefile doc/credentials/Makefile doc/credentials/x509/Makefile doc/credentials/srp/Makefile doc/credentials/openpgp/Makefile gl/Makefile lgl/Makefile tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile tests/pkcs12-decode/Makefile tests/pathlen/Makefile tests/key-id/Makefile tests/sha2/Makefile tests/hostname-check/Makefile includes/Makefile includes/gnutls/gnutls.h lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile libextra/Makefile lib/openpgp/Makefile lib/opencdk/Makefile tests/openpgp/Makefile tests/openpgp-certs/Makefile src/Makefile src/cfg/Makefile src/cfg/platon/Makefile src/cfg/platon/str/Makefile lib/libgnutls-config libextra/libgnutls-extra-config lib/gnutls.pc libextra/gnutls-extra.pc guile/Makefile guile/modules/Makefile guile/src/Makefile guile/tests/Makefile" +ac_config_files="$ac_config_files Makefile po/Makefile.in doc/Makefile doc/examples/Makefile doc/scripts/Makefile doc/manpages/Makefile doc/reference/Makefile doc/credentials/Makefile doc/credentials/x509/Makefile doc/credentials/srp/Makefile doc/credentials/openpgp/Makefile gl/Makefile lgl/Makefile tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile tests/pkcs12-decode/Makefile tests/pathlen/Makefile tests/key-id/Makefile tests/sha2/Makefile tests/hostname-check/Makefile includes/Makefile includes/gnutls/gnutls.h lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile libextra/Makefile lib/openpgp/Makefile lib/opencdk/Makefile tests/openpgp/Makefile tests/openpgp-certs/Makefile tests/safe-renegotiation/Makefile src/Makefile src/cfg/Makefile src/cfg/platon/Makefile src/cfg/platon/str/Makefile lib/libgnutls-config libextra/libgnutls-extra-config lib/gnutls.pc libextra/gnutls-extra.pc guile/Makefile guile/modules/Makefile guile/src/Makefile guile/tests/Makefile" ac_config_files="$ac_config_files guile/pre-inst-guile" @@ -47481,6 +47481,7 @@ do "lib/opencdk/Makefile") CONFIG_FILES="$CONFIG_FILES lib/opencdk/Makefile" ;; "tests/openpgp/Makefile") CONFIG_FILES="$CONFIG_FILES tests/openpgp/Makefile" ;; "tests/openpgp-certs/Makefile") CONFIG_FILES="$CONFIG_FILES tests/openpgp-certs/Makefile" ;; + "tests/safe-renegotiation/Makefile") CONFIG_FILES="$CONFIG_FILES tests/safe-renegotiation/Makefile" ;; "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;; "src/cfg/Makefile") CONFIG_FILES="$CONFIG_FILES src/cfg/Makefile" ;; "src/cfg/platon/Makefile") CONFIG_FILES="$CONFIG_FILES src/cfg/platon/Makefile" ;; Index: gnutls-2.4.1/includes/gnutls/gnutls.h.in =================================================================== --- gnutls-2.4.1.orig/includes/gnutls/gnutls.h.in +++ gnutls-2.4.1/includes/gnutls/gnutls.h.in @@ -481,6 +481,9 @@ extern "C" void *data, size_t * data_length, unsigned int *type, unsigned int indx); + /* Safe renegotiation */ + int gnutls_safe_renegotiation_status (gnutls_session_t session); + /* Opaque PRF Input * http://tools.ietf.org/id/draft-rescorla-tls-opaque-prf-input-00.txt */ @@ -1303,6 +1306,9 @@ extern "C" #define GNUTLS_E_IA_VERIFY_FAILED -104 #define GNUTLS_E_UNKNOWN_ALGORITHM -105 +#define GNUTLS_E_SAFE_RENEGOTIATION_FAILED -107 +#define GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED -108 +#define GNUTLS_E_UNKNOWN_SRP_USERNAME -109 #define GNUTLS_E_BASE64_ENCODING_ERROR -201 #define GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY -202 /* obsolete */ Index: gnutls-2.4.1/lib/Makefile.am =================================================================== --- gnutls-2.4.1.orig/lib/Makefile.am +++ gnutls-2.4.1/lib/Makefile.am @@ -84,7 +84,7 @@ COBJECTS = gnutls_record.c gnutls_compre gnutls_x509.c ext_cert_type.c gnutls_rsa_export.c \ auth_rsa_export.c ext_server_name.c auth_dh_common.c \ gnutls_helper.c ext_inner_application.c \ - gnutls_supplemental.c crypto.c random.c + gnutls_supplemental.c crypto.c random.c ext_safe_renegotiation.c if ENABLE_OPRFI COBJECTS += $(OPRFI_COBJECTS) @@ -105,7 +105,7 @@ HFILES = debug.h gnutls_compress.h defin ext_srp.h gnutls_srp.h auth_srp.h auth_srp_passwd.h \ gnutls_helper.h auth_psk.h auth_psk_passwd.h \ ext_inner_application.h gnutls_supplemental.h ext_oprfi.h \ - crypto.h random.h + crypto.h random.h ext_safe_renegotiation.h # Separate so we can create the documentation Index: gnutls-2.4.1/lib/Makefile.in =================================================================== --- gnutls-2.4.1.orig/lib/Makefile.in +++ gnutls-2.4.1/lib/Makefile.in @@ -224,7 +224,7 @@ am__objects_4 = gnutls_record.lo gnutls_ gnutls_state.lo gnutls_x509.lo ext_cert_type.lo \ gnutls_rsa_export.lo auth_rsa_export.lo ext_server_name.lo \ auth_dh_common.lo gnutls_helper.lo ext_inner_application.lo \ - gnutls_supplemental.lo crypto.lo random.lo $(am__objects_3) + gnutls_supplemental.lo crypto.lo random.lo ext_safe_renegotiation.lo $(am__objects_3) am__objects_5 = ext_srp.lo gnutls_srp.lo auth_srp.lo \ auth_srp_passwd.lo auth_srp_sb64.lo auth_srp_rsa.lo am__objects_6 = auth_psk.lo auth_psk_passwd.lo gnutls_psk.lo \ @@ -731,7 +731,7 @@ COBJECTS = gnutls_record.c gnutls_compre gnutls_x509.c ext_cert_type.c gnutls_rsa_export.c \ auth_rsa_export.c ext_server_name.c auth_dh_common.c \ gnutls_helper.c ext_inner_application.c gnutls_supplemental.c \ - crypto.c random.c $(am__append_6) + crypto.c random.c ext_safe_renegotiation.c $(am__append_6) HFILES = debug.h gnutls_compress.h defines.h gnutls_cipher.h \ gnutls_buffers.h gnutls_errors.h gnutls_int.h \ gnutls_handshake.h gnutls_num.h gnutls_algorithms.h \ @@ -747,7 +747,7 @@ HFILES = debug.h gnutls_compress.h defin ext_srp.h gnutls_srp.h auth_srp.h auth_srp_passwd.h \ gnutls_helper.h auth_psk.h auth_psk_passwd.h \ ext_inner_application.h gnutls_supplemental.h ext_oprfi.h \ - crypto.h random.h + crypto.h random.h ext_safe_renegotiation.h # Separate so we can create the documentation @@ -933,6 +933,7 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pkix_asn1_tab.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/x509_b64.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext_safe_renegotiation.Plo@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< Index: gnutls-2.4.1/lib/ext_safe_renegotiation.c =================================================================== --- /dev/null +++ gnutls-2.4.1/lib/ext_safe_renegotiation.c @@ -0,0 +1,139 @@ +/* + * Copyright (C) 2009 Free Software Foundation + * + * Author: Steve Dispensa (<dispensa@phonefactor.com>) + * + * This file is part of GNUTLS. + * + * The GNUTLS library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +#include <gnutls_int.h> +#include <ext_safe_renegotiation.h> +#include <gnutls_errors.h> + +int +_gnutls_safe_renegotiation_recv_params (gnutls_session_t session, + const opaque * data, size_t _data_size) +{ + tls_ext_st *ext = &session->security_parameters.extensions; + int len = data[0]; + ssize_t data_size = _data_size; + + DECR_LEN (data_size, len+1 /* count the first byte and payload */); + + if (session->internals.priorities.sr == SR_DISABLED) + { + gnutls_assert (); + return 0; + } + + /* It is not legal to receive this extension on a renegotiation and + * not receive it on the initial negotiation. + */ + if (session->internals.initial_negotiation_completed != 0 && + session->internals.connection_using_safe_renegotiation == 0) + { + gnutls_assert(); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + + if (len > sizeof (ext->ri_extension_data)) + { + gnutls_assert(); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + + if (len > 0) + memcpy (ext->ri_extension_data, &data[1], len); + ext->ri_extension_data_len = len; + + /* "safe renegotiation received" means on *this* handshake; "connection using + * safe renegotiation" means that the initial hello received on the connection + * indicated safe renegotiation. + */ + session->internals.safe_renegotiation_received = 1; + session->internals.connection_using_safe_renegotiation = 1; + + return 0; +} + +int +_gnutls_safe_renegotiation_send_params (gnutls_session_t session, + opaque * data, size_t _data_size) +{ + /* The format of this extension is a one-byte length of verify data followed + * by the verify data itself. Note that the length byte does not include + * itself; IOW, empty verify data is represented as a length of 0. That means + * the minimum extension is one byte: 0x00. + */ + ssize_t data_size = _data_size; + tls_ext_st *ext = &session->security_parameters.extensions; + + + if (session->internals.priorities.sr == SR_DISABLED) + { + gnutls_assert(); + return 0; + } + + data[0] = 0; + + /* Always offer the extension if we're a client */ + if (session->internals.connection_using_safe_renegotiation || + session->security_parameters.entity == GNUTLS_CLIENT) + { + DECR_LEN (data_size, 1); + data[0] = ext->client_verify_data_len; + + DECR_LEN (data_size, ext->client_verify_data_len); + + if (ext->client_verify_data_len > 0) + memcpy(&data[1], + ext->client_verify_data, + ext->client_verify_data_len); + + if (session->security_parameters.entity == GNUTLS_SERVER) + { + data[0] += ext->server_verify_data_len; + + DECR_LEN (data_size, ext->server_verify_data_len); + + if (ext->server_verify_data_len > 0) + memcpy(&data[1 + ext->client_verify_data_len], + ext->server_verify_data, + ext->server_verify_data_len); + } + } + else + return 0; + + return 1 + data[0]; /* don't forget the length byte */ +} + +/** + * gnutls_safe_renegotiation_status: + * @session: is a #gnutls_session_t structure. + * + * Can be used to check whether safe renegotiation is being used + * in the current session. Returns 0 when not and non zero when + * used. + **/ +int gnutls_safe_renegotiation_status (gnutls_session_t session) +{ + return session->internals.connection_using_safe_renegotiation; +} Index: gnutls-2.4.1/lib/ext_safe_renegotiation.h =================================================================== --- /dev/null +++ gnutls-2.4.1/lib/ext_safe_renegotiation.h @@ -0,0 +1,33 @@ +/* + * Copyright (C) 2009 Free Software Foundation + * + * Author: Steve Dispensa (<dispensa@phonefactor.com>) + * + * This file is part of GNUTLS. + * + * The GNUTLS library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, + * USA + * + */ + +#ifndef EXT_SAFE_RENEGOTIATION_H +# define EXT_SAFE_RENEGOTIATION_H + +int _gnutls_safe_renegotiation_recv_params (gnutls_session_t state, + const opaque * data, size_t data_size); +int _gnutls_safe_renegotiation_send_params (gnutls_session_t state, + opaque * data, size_t); + +#endif /* EXT_SAFE_RENEGOTIATION_H */ Index: gnutls-2.4.1/lib/gnutls_alert.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_alert.c +++ gnutls-2.4.1/lib/gnutls_alert.c @@ -179,6 +179,10 @@ gnutls_error_to_alert (int err, int *lev ret = GNUTLS_A_ILLEGAL_PARAMETER; _level = GNUTLS_AL_FATAL; break; + case GNUTLS_E_UNKNOWN_SRP_USERNAME: + ret = GNUTLS_A_UNKNOWN_PSK_IDENTITY; + _level = GNUTLS_AL_FATAL; + break; case GNUTLS_E_ASN1_ELEMENT_NOT_FOUND: case GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND: case GNUTLS_E_ASN1_DER_ERROR: @@ -198,6 +202,7 @@ gnutls_error_to_alert (int err, int *lev case GNUTLS_E_INSUFFICIENT_CREDENTIALS: case GNUTLS_E_NO_CIPHER_SUITES: case GNUTLS_E_NO_COMPRESSION_ALGORITHMS: + case GNUTLS_E_SAFE_RENEGOTIATION_FAILED: ret = GNUTLS_A_HANDSHAKE_FAILURE; _level = GNUTLS_AL_FATAL; break; @@ -211,6 +216,7 @@ gnutls_error_to_alert (int err, int *lev _level = GNUTLS_AL_FATAL; break; case GNUTLS_E_REHANDSHAKE: + case GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED: ret = GNUTLS_A_NO_RENEGOTIATION; _level = GNUTLS_AL_WARNING; break; Index: gnutls-2.4.1/lib/gnutls_algorithms.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_algorithms.c +++ gnutls-2.4.1/lib/gnutls_algorithms.c @@ -472,6 +472,9 @@ typedef struct #define GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x45 } #define GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x88 } +/* Safe renegotiation */ +#define GNUTLS_RENEGO_PROTECTION_REQUEST { GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR, GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR } + #define CIPHER_SUITES_COUNT sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry)-1 static const gnutls_cipher_suite_entry cs_algorithms[] = { @@ -639,6 +642,9 @@ static const gnutls_cipher_suite_entry c GNUTLS_CIPHER_CAMELLIA_256_CBC, GNUTLS_KX_RSA, GNUTLS_MAC_SHA1, GNUTLS_TLS1), #endif + GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RENEGO_PROTECTION_REQUEST, + GNUTLS_CIPHER_UNKNOWN, GNUTLS_KX_UNKNOWN, + GNUTLS_MAC_UNKNOWN, GNUTLS_SSL3), {0, {{0, 0}}, 0, 0, 0, 0} }; Index: gnutls-2.4.1/lib/gnutls_algorithms.h =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_algorithms.h +++ gnutls-2.4.1/lib/gnutls_algorithms.h @@ -27,6 +27,9 @@ #include "gnutls_auth.h" +#define GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR 0x00 +#define GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR 0xFF + /* Functions for version handling. */ gnutls_protocol_t _gnutls_version_lowest (gnutls_session_t session); gnutls_protocol_t _gnutls_version_max (gnutls_session_t session); Index: gnutls-2.4.1/lib/gnutls_constate.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_constate.c +++ gnutls-2.4.1/lib/gnutls_constate.c @@ -426,6 +426,17 @@ _gnutls_set_write_keys (gnutls_session_t export_flag); } +#define CPY_EXTENSIONS \ + memcpy(dst->extensions.server_names, src->extensions.server_names, sizeof(src->extensions.server_names)); \ + dst->extensions.server_names_size = src->extensions.server_names_size; \ + memcpy(dst->extensions.srp_username, src->extensions.srp_username, sizeof(src->extensions.srp_username)); \ + dst->extensions.gnutls_ia_enable = src->extensions.gnutls_ia_enable; \ + dst->extensions.gnutls_ia_peer_enable = src->extensions.gnutls_ia_peer_enable; \ + dst->extensions.gnutls_ia_allowskip = src->extensions.gnutls_ia_allowskip; \ + dst->extensions.gnutls_ia_peer_allowskip = src->extensions.gnutls_ia_peer_allowskip; \ + dst->extensions.do_recv_supplemental = src->extensions.do_recv_supplemental; \ + dst->extensions.do_send_supplemental = src->extensions.do_send_supplemental + #define CPY_COMMON dst->entity = src->entity; \ dst->kx_algorithm = src->kx_algorithm; \ memcpy( &dst->current_cipher_suite, &src->current_cipher_suite, sizeof(cipher_suite_st)); \ @@ -439,8 +450,8 @@ _gnutls_set_write_keys (gnutls_session_t dst->max_record_recv_size = src->max_record_recv_size; \ dst->max_record_send_size = src->max_record_send_size; \ dst->version = src->version; \ - memcpy( &dst->extensions, &src->extensions, sizeof(tls_ext_st)); \ - memcpy( &dst->inner_secret, &src->inner_secret, TLS_MASTER_SIZE); + CPY_EXTENSIONS; \ + memcpy( &dst->inner_secret, &src->inner_secret, TLS_MASTER_SIZE) static void _gnutls_cpy_read_security_parameters (security_parameters_st * Index: gnutls-2.4.1/lib/gnutls_errors.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_errors.c +++ gnutls-2.4.1/lib/gnutls_errors.c @@ -214,9 +214,15 @@ static const gnutls_error_entry error_al GNUTLS_E_OPENPGP_GETKEY_FAILED, 1), ERROR_ENTRY (N_("Could not find OpenPGP subkey."), GNUTLS_E_OPENPGP_SUBKEY_ERROR, 1), + ERROR_ENTRY (N_("Safe renegotiation failed."), + GNUTLS_E_SAFE_RENEGOTIATION_FAILED, 1), + ERROR_ENTRY (N_("Unsafe renegotiation denied."), + GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED, 1), ERROR_ENTRY (N_("The SRP username supplied is illegal."), GNUTLS_E_ILLEGAL_SRP_USERNAME, 1), + ERROR_ENTRY (N_("The SRP username supplied is unknown."), + GNUTLS_E_UNKNOWN_SRP_USERNAME, 1), ERROR_ENTRY (N_("The OpenPGP fingerprint is not supported."), GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED, 1), Index: gnutls-2.4.1/lib/gnutls_extensions.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_extensions.c +++ gnutls-2.4.1/lib/gnutls_extensions.c @@ -35,6 +35,7 @@ #include <ext_server_name.h> #include <ext_oprfi.h> #include <ext_srp.h> +#include <ext_safe_renegotiation.h> #include <ext_inner_application.h> #include <gnutls_num.h> @@ -59,6 +60,10 @@ gnutls_extension_entry _gnutls_extension EXTENSION_APPLICATION, _gnutls_server_name_recv_params, _gnutls_server_name_send_params), + GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_SAFE_RENEGOTIATION, + GNUTLS_EXT_MANDATORY, + _gnutls_safe_renegotiation_recv_params, + _gnutls_safe_renegotiation_send_params), #ifdef ENABLE_OPRFI GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_OPAQUE_PRF_INPUT, EXTENSION_TLS, @@ -174,7 +179,7 @@ _gnutls_parse_extensions (gnutls_session type = _gnutls_read_uint16 (&data[pos]); pos += 2; - _gnutls_debug_log ("EXT[%x]: Received extension '%s/%d'\n", session, + _gnutls_debug_log ("EXT[%p]: Found extension '%s/%d'\n", session, _gnutls_extension_get_name (type),type); if ((ret = _gnutls_extension_list_check (session, type)) < 0) @@ -211,7 +216,7 @@ _gnutls_parse_extensions (gnutls_session * This list is used to check whether the (later) received * extensions are the ones we requested. */ -static void +void _gnutls_extension_list_add (gnutls_session_t session, uint16_t type) { @@ -232,7 +237,7 @@ _gnutls_extension_list_add (gnutls_sessi int _gnutls_gen_extensions (gnutls_session_t session, opaque * data, - size_t data_size) + size_t data_size, tls_ext_parse_type_t parse_type) { int size; uint16_t pos = 0; @@ -263,6 +268,10 @@ _gnutls_gen_extensions (gnutls_session_t ext_send = _gnutls_ext_func_send (p->type); if (ext_send == NULL) continue; + + if (parse_type != EXTENSION_ANY && p->parse_type != parse_type) + continue; + size = ext_send (session, sdata, sdata_size); if (size > 0) { Index: gnutls-2.4.1/lib/gnutls_extensions.h =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_extensions.h +++ gnutls-2.4.1/lib/gnutls_extensions.h @@ -27,7 +27,7 @@ const char *_gnutls_extension_get_name (uint16_t type); int _gnutls_parse_extensions (gnutls_session_t, tls_ext_parse_type_t, const opaque *, int); int _gnutls_gen_extensions (gnutls_session_t session, opaque * data, - size_t data_size); + size_t data_size, tls_ext_parse_type_t); typedef int (*ext_recv_func) (gnutls_session_t, const opaque *, size_t); /* recv data */ typedef int (*ext_send_func) (gnutls_session_t, opaque *, size_t); /* send data */ @@ -43,3 +43,5 @@ typedef struct ext_recv_func gnutls_ext_func_recv; ext_send_func gnutls_ext_func_send; } gnutls_extension_entry; + +void _gnutls_extension_list_add (gnutls_session_t session, uint16_t type); Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -48,6 +48,7 @@ #include <gnutls_record.h> #include <gnutls_state.h> #include <ext_srp.h> +#include <ext_safe_renegotiation.h> #include <gnutls_rsa_export.h> /* for gnutls_get_rsa_params() */ #include <auth_anon.h> /* for gnutls_anon_server_credentials_t */ #include <auth_psk.h> /* for gnutls_psk_server_credentials_t */ @@ -396,6 +397,33 @@ _gnutls_read_client_hello (gnutls_sessio if (ret == 0) { /* resumed! */ + /* Parse only the safe renegotiation extension + * We don't want to parse any other extensions since + * we don't want new extension values to overwrite the + * resumed ones. + */ + + /* move forward to extensions */ + DECR_LEN (len, 2); + suite_size = _gnutls_read_uint16 (&data[pos]); + pos += 2; + + DECR_LEN (len, suite_size); + pos += suite_size; + + DECR_LEN (len, 1); + comp_size = data[pos++]; /* z is the number of compression methods */ + DECR_LEN (len, comp_size); + pos += comp_size; + + ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY, + &data[pos], len); + if (ret < 0) + { + gnutls_assert (); + return ret; + } + resume_copy_required_values (session); session->internals.resumed = RESUME_TRUE; return _gnutls_user_hello_func( session, adv_version); @@ -430,16 +458,18 @@ _gnutls_read_client_hello (gnutls_sessio pos += comp_size; /* Parse the extensions (if any) - */ - if (neg_version >= GNUTLS_TLS1) - { - ret = _gnutls_parse_extensions (session, EXTENSION_APPLICATION, &data[pos], len); /* len is the rest of the parsed length */ - if (ret < 0) - { + * + * Unconditionally try to parse extensions; safe renegotiation uses them in + * sslv3 and higher, even though sslv3 doesn't officially support them. + */ + ret = _gnutls_parse_extensions (session, EXTENSION_APPLICATION, + &data[pos], len); + /* len is the rest of the parsed length */ + if (ret < 0) + { gnutls_assert (); return ret; - } - } + } ret = _gnutls_user_hello_func( session, adv_version); if (ret < 0) @@ -448,15 +478,20 @@ _gnutls_read_client_hello (gnutls_sessio return ret; } - if (neg_version >= GNUTLS_TLS1) - { - ret = _gnutls_parse_extensions (session, EXTENSION_TLS, &data[pos], len); /* len is the rest of the parsed length */ - if (ret < 0) - { + ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY, + &data[pos], len); + if (ret < 0) + { gnutls_assert (); return ret; - } - } + } + ret = _gnutls_parse_extensions (session, EXTENSION_TLS, + &data[pos], len); + if (ret < 0) + { + gnutls_assert (); + return ret; + } /* select an appropriate cipher suite */ @@ -520,7 +555,7 @@ _gnutls_handshake_hash_pending (gnutls_s int _gnutls_send_finished (gnutls_session_t session, int again) { - uint8_t data[36]; + uint8_t data[MAX_VERIFY_DATA_SIZE]; int ret; int data_size = 0; @@ -560,6 +595,31 @@ _gnutls_send_finished (gnutls_session_t } + /* Save data for safe renegotiation. + */ + if (data_size > MAX_VERIFY_DATA_SIZE) + { + gnutls_assert (); + return GNUTLS_E_UNEXPECTED_PACKET_LENGTH; + } + + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + session->security_parameters.extensions.client_verify_data_len = + data_size; + + memcpy (session->security_parameters.extensions.client_verify_data, + data, data_size); + } + else + { + session->security_parameters.extensions.server_verify_data_len = + data_size; + + memcpy (session->security_parameters.extensions.server_verify_data, + data, data_size); + } + ret = _gnutls_send_handshake (session, data, data_size, GNUTLS_HANDSHAKE_FINISHED); @@ -573,10 +633,11 @@ _gnutls_send_finished (gnutls_session_t int _gnutls_recv_finished (gnutls_session_t session) { - uint8_t data[36], *vrfy; + uint8_t data[MAX_VERIFY_DATA_SIZE], *vrfy; int data_size; int ret; int vrfysize; + tls_ext_st *ext; ret = _gnutls_recv_handshake (session, &vrfy, &vrfysize, @@ -634,6 +695,28 @@ _gnutls_recv_finished (gnutls_session_t } gnutls_free (vrfy); + /* Save peer's verify data for safe renegotiation */ + if (data_size > MAX_VERIFY_DATA_SIZE) + { + gnutls_assert (); + return GNUTLS_E_UNEXPECTED_PACKET_LENGTH; + } + + ext = &session->security_parameters.extensions; + + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + memcpy (ext->server_verify_data, data, data_size); + ext->server_verify_data_len = data_size; + } + else + { + memcpy (ext->client_verify_data, data, data_size); + ext->client_verify_data_len = data_size; + } + + session->internals.initial_negotiation_completed = 1; + return ret; } @@ -688,6 +771,26 @@ _gnutls_server_select_suite (gnutls_sess * supported by the peer. */ + /* First, check for safe renegotiation SCSV. + */ + if (session->internals.priorities.sr != SR_DISABLED) + { + int offset; + + for(offset = 0; offset < datalen; offset += 2) + { + /* TLS_RENEGO_PROTECTION_REQUEST = { 0x00, 0xff } */ + if (data[offset] == GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR && + data[offset+1] == GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR) + { + _gnutls_handshake_log ("HSK[%p]: Received safe renegotiation CS\n", session); + session->internals.safe_renegotiation_received = 1; + session->internals.connection_using_safe_renegotiation = 1; + break; + } + } + } + pk_algo = _gnutls_server_find_pk_algos_in_ciphersuites (data, datalen); x = _gnutls_supported_ciphersuites (session, &ciphers); @@ -1029,7 +1132,6 @@ _gnutls_recv_handshake_header (gnutls_se if (ret < 0) { - gnutls_assert (); return ret; } @@ -1520,8 +1622,21 @@ _gnutls_read_server_hello (gnutls_sessio * values; */ if (_gnutls_client_check_if_resuming - (session, &data[pos], session_id_len) == 0) - return 0; + (session, &data[pos], session_id_len) == 0) + { + pos += session_id_len + 2 + 1; + DECR_LEN (len, 2+1); + + ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY, + &data[pos], len); + if (ret < 0) + { + gnutls_assert (); + return ret; + } + return 0; + } + pos += session_id_len; @@ -1553,30 +1668,31 @@ _gnutls_read_server_hello (gnutls_sessio /* Parse extensions. */ - if (version >= GNUTLS_TLS1) - { - ret = _gnutls_parse_extensions (session, EXTENSION_ANY, &data[pos], len); /* len is the rest of the parsed length */ - if (ret < 0) - { + ret = _gnutls_parse_extensions (session, EXTENSION_ANY, + &data[pos], len); + if (ret < 0) + { gnutls_assert (); return ret; - } - } + } return ret; } /* This function copies the appropriate ciphersuites to a locally allocated buffer - * Needed in client hello messages. Returns the new data length. + * Needed in client hello messages. Returns the new data length,If add_scsv is + * true, add the special safe renegotiation CS. */ static int _gnutls_copy_ciphersuites (gnutls_session_t session, - opaque * ret_data, size_t ret_data_size) + opaque * ret_data, size_t ret_data_size, + int add_scsv) { int ret, i; cipher_suite_st *cipher_suites; uint16_t cipher_num; int datalen, pos; + uint16_t loop_max; ret = _gnutls_supported_ciphersuites_sorted (session, &cipher_suites); if (ret < 0) @@ -1607,6 +1723,9 @@ _gnutls_copy_ciphersuites (gnutls_sessio return GNUTLS_E_INSUFFICIENT_CREDENTIALS; } + if (add_scsv) + ++ret; + cipher_num = ret; cipher_num *= sizeof (uint16_t); /* in order to get bytes */ @@ -1624,11 +1743,21 @@ _gnutls_copy_ciphersuites (gnutls_sessio _gnutls_write_uint16 (cipher_num, ret_data); pos += 2; - for (i = 0; i < (cipher_num / 2); i++) + loop_max = add_scsv ? cipher_num - 2 : cipher_num; + + for (i = 0; i < (loop_max / 2); i++) { memcpy (&ret_data[pos], cipher_suites[i].suite, 2); pos += 2; } + + if (add_scsv) + { + /* Safe renegotiation signalling CS value is { 0x00, 0xff } */ + ret_data[pos++] = 0x00; + ret_data[pos++] = 0xff; + } + gnutls_free (cipher_suites); return datalen; @@ -1688,7 +1817,7 @@ _gnutls_send_client_hello (gnutls_sessio { opaque *data = NULL; int extdatalen; - int pos = 0; + int pos = 0, type; int datalen = 0, ret = 0; opaque rnd[TLS_RANDOM_SIZE]; gnutls_protocol_t hver; @@ -1777,9 +1906,21 @@ _gnutls_send_client_hello (gnutls_sessio /* Copy the ciphersuites. + * + * If using SSLv3 Send TLS_RENEGO_PROTECTION_REQUEST SCSV for MITM + * prevention on initial negotiation (but not renegotiation; that's + * handled with the RI extension below). */ - extdatalen = - _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata)); + if(!session->internals.initial_negotiation_completed && + session->security_parameters.entity == GNUTLS_CLIENT && + gnutls_protocol_get_version (session) == GNUTLS_SSL3) + { + extdatalen = _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata), TRUE); + _gnutls_extension_list_add (session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION); + } + else + extdatalen = _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata), FALSE); + if (extdatalen > 0) { datalen += extdatalen; @@ -1834,9 +1975,17 @@ _gnutls_send_client_hello (gnutls_sessio /* Generate and copy TLS extensions. */ if (hver >= GNUTLS_TLS1) - { - extdatalen = - _gnutls_gen_extensions (session, extdata, sizeof (extdata)); + type = EXTENSION_ANY; + else + { + if (session->internals.initial_negotiation_completed != 0) + type = GNUTLS_EXT_MANDATORY; + else + type = GNUTLS_EXT_NONE; + } + + extdatalen = + _gnutls_gen_extensions (session, extdata, sizeof (extdata), type); if (extdatalen > 0) { @@ -1856,7 +2005,6 @@ _gnutls_send_client_hello (gnutls_sessio gnutls_free (data); return extdatalen; } - } } ret = @@ -1902,15 +2050,7 @@ _gnutls_send_server_hello (gnutls_sessio * alert and abort. */ gnutls_assert (); - ret = gnutls_alert_send (session, GNUTLS_AL_FATAL, - GNUTLS_A_UNKNOWN_PSK_IDENTITY); - if (ret < 0) - { - gnutls_assert (); - return ret; - } - - return GNUTLS_E_ILLEGAL_SRP_USERNAME; + return GNUTLS_E_UNKNOWN_SRP_USERNAME; } } #endif @@ -1919,7 +2059,7 @@ _gnutls_send_server_hello (gnutls_sessio { datalen = 2 + session_id_len + 1 + TLS_RANDOM_SIZE + 3; extdatalen = - _gnutls_gen_extensions (session, extdata, sizeof (extdata)); + _gnutls_gen_extensions (session, extdata, sizeof (extdata), EXTENSION_ANY); if (extdatalen < 0) { @@ -1985,6 +2125,8 @@ _gnutls_send_hello (gnutls_session_t ses { int ret; + session->internals.safe_renegotiation_received = 0; + if (session->security_parameters.entity == GNUTLS_CLIENT) { ret = _gnutls_send_client_hello (session, again); @@ -2006,6 +2148,7 @@ int _gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen) { int ret; + tls_ext_st *ext; if (session->security_parameters.entity == GNUTLS_CLIENT) { @@ -2027,6 +2170,89 @@ _gnutls_recv_hello (gnutls_session_t ses } } + if (session->internals.priorities.sr == SR_DISABLED) + { + gnutls_assert(); + return ret; + } + + /* Safe renegotiation */ + ext = &session->security_parameters.extensions; + + if (session->internals.safe_renegotiation_received) + { + if ((ext->ri_extension_data_len < ext->client_verify_data_len) || + (memcmp (ext->ri_extension_data, + ext->client_verify_data, + ext->client_verify_data_len))) + { + gnutls_assert(); + _gnutls_handshake_log ("Safe renegotiation failed [1]\n"); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + if (session->security_parameters.entity == GNUTLS_CLIENT) + { + if ((ext->ri_extension_data_len != + ext->client_verify_data_len + ext->server_verify_data_len) || + memcmp (ext->ri_extension_data + ext->client_verify_data_len, + ext->server_verify_data, ext->server_verify_data_len) != 0) + { + gnutls_assert(); + _gnutls_handshake_log ("Safe renegotiation failed [2]\n"); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + } + else /* Make sure there are 0 extra bytes */ + { + if (ext->ri_extension_data_len != ext->client_verify_data_len) + { + gnutls_assert(); + _gnutls_handshake_log ("Safe renegotiation failed [3]\n"); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + } + + _gnutls_handshake_log ("Safe renegotiation succeeded.\n"); + } + else /* safe renegotiation not received... */ + { + if (session->internals.connection_using_safe_renegotiation) + { + gnutls_assert(); + _gnutls_handshake_log ("Peer previously asked for safe renegotiation!\n"); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + + /* Clients can't tell if it's an initial negotiation */ + if (session->internals.initial_negotiation_completed) + { + + if (session->internals.priorities.sr < SR_PARTIAL) + { + _gnutls_handshake_log ("Allowing unsafe (re)negotiation!\n"); + } + else + { + gnutls_assert(); + _gnutls_handshake_log ("Denying unsafe (re)negotiation.\n"); + return GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED; + } + } + else + { + if (session->internals.priorities.sr < SR_SAFE) + { + _gnutls_handshake_log ("Allowing unsafe initial negotiation!\n"); + } + else + { + gnutls_assert(); + _gnutls_handshake_log ("Denying unsafe initial negotiation.\n"); + return GNUTLS_E_SAFE_RENEGOTIATION_FAILED; + } + } + } + return ret; } @@ -2067,6 +2293,13 @@ _gnutls_recv_hello (gnutls_session_t ses * gnutls_handshake() function in order to negotiate the new * parameters. * + * Since TLS is full duplex some application data might have been + * sent during peer's processing of this message. In that case + * one should call gnutls_record_recv() until GNUTLS_E_REHANDSHAKE + * is returned to clear any pending data. Care must be taken if + * rehandshake is mandatory to terminate if it does not start after + * some threshold. + * * If the client does not wish to renegotiate parameters he will * should with an alert message, thus the return code will be * %GNUTLS_E_WARNING_ALERT_RECEIVED and the alert will be Index: gnutls-2.4.1/lib/gnutls_int.h =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_int.h +++ gnutls-2.4.1/lib/gnutls_int.h @@ -142,7 +142,8 @@ typedef enum extensions_t GNUTLS_EXTENSION_OPAQUE_PRF_INPUT = ENABLE_OPRFI, #endif GNUTLS_EXTENSION_SRP = 12, - GNUTLS_EXTENSION_INNER_APPLICATION = 37703 + GNUTLS_EXTENSION_INNER_APPLICATION = 37703, + GNUTLS_EXTENSION_SAFE_RENEGOTIATION = 65281, /* aka: 0xff01 */ } extensions_t; typedef enum @@ -257,6 +258,11 @@ typedef struct } server_name_st; #define MAX_SERVER_NAME_EXTENSIONS 3 +#define MAX_VERIFY_DATA_SIZE 36 /* in SSL 3.0, 12 in TLS 1.0 */ + +/* If you want the extension data to be kept across resuming sessions + * then modify CPY_EXTENSIONS in gnutls_constate.c + */ typedef struct { @@ -273,6 +279,9 @@ typedef struct /* Used by extensions that enable supplemental data. */ int do_recv_supplemental, do_send_supplemental; + /*** Those below do not get copied when resuming session + ***/ + /* Opaque PRF input. */ gnutls_oprfi_callback_func oprfi_cb; void *oprfi_userdata; @@ -280,6 +289,15 @@ typedef struct uint16_t oprfi_client_len; opaque *oprfi_server; uint16_t oprfi_server_len; + + /* Safe renegotiation. */ + uint8_t client_verify_data[MAX_VERIFY_DATA_SIZE]; + size_t client_verify_data_len; + uint8_t server_verify_data[MAX_VERIFY_DATA_SIZE]; + size_t server_verify_data_len; + uint8_t ri_extension_data[MAX_VERIFY_DATA_SIZE*2]; /* max signal is 72 bytes in s->c sslv3 */ + size_t ri_extension_data_len; + } tls_ext_st; /* This flag indicates for an extension whether @@ -291,7 +309,9 @@ typedef enum tls_ext_parse_type_t { EXTENSION_ANY, EXTENSION_APPLICATION, - EXTENSION_TLS + EXTENSION_TLS, + GNUTLS_EXT_MANDATORY, /* parse even if resuming or extensions disabled */ + GNUTLS_EXT_NONE, } tls_ext_parse_type_t; /* auth_info_t structures now MAY contain malloced @@ -388,6 +408,13 @@ typedef struct unsigned int algorithms; } priority_st; +typedef enum { + SR_DISABLED, + SR_UNSAFE, + SR_PARTIAL, + SR_SAFE, +} safe_renegotiation_t; + /* For the external api */ struct gnutls_priority_st { @@ -399,7 +426,8 @@ struct gnutls_priority_st priority_st cert_type; /* to disable record padding */ - int no_padding; + int no_padding:1; + safe_renegotiation_t sr; }; @@ -651,6 +679,10 @@ typedef struct gnutls_sign_func sign_func; void *sign_func_userdata; + int safe_renegotiation_received:1; + int initial_negotiation_completed:1; + int connection_using_safe_renegotiation:1; + /* If you add anything here, check _gnutls_handshake_internal_state_clear(). */ } internals_st; Index: gnutls-2.4.1/lib/gnutls_priority.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_priority.c +++ gnutls-2.4.1/lib/gnutls_priority.c @@ -473,6 +473,22 @@ gnutls_priority_set (gnutls_session_t se * '+' appended with an algorithm will add this algorithm. * '%COMPAT' will enable compatibility features for a server. * + * "%DISABLE_SAFE_RENEGOTIATION" will disable safe renegotiation completely. Do not use + * unless you know what you are doing. Testing purposes only. + * + * "%UNSAFE_RENEGOTIATION" will allow unsafe renegotiation (this is now + * the default for clients, but will change once more servers support the safe renegotiation + * TLS fix). + * + * "%PARTIAL_SAFE_RENEGOTIATION" In server side it will enable safe renegotiation + * and will protect all clients from known attacks, but will not prevent insecure clients + * from connecting. In client side it will disallow from renegotiating with an insecure server + * but will not prevent connecting to one (this leaves the client vulnerable to attacks). + * + * "%SAFE_RENEGOTIATION" will enforce safe renegotiation. Clients and Servers will refuse + * to talk to an insecure peer. + * + * * To avoid collisions in order to specify a compression algorithm in * this string you have to prefix it with "COMP-", protocol versions * with "VERS-" and certificate types with "CTYPE-". All other @@ -502,7 +518,7 @@ gnutls_priority_init (gnutls_priority_t { char *broken_list[MAX_ELEMENTS]; int broken_list_size, i, j; - char *darg; + char *darg = NULL; int algo; rmadd_func *fn; @@ -512,6 +528,11 @@ gnutls_priority_init (gnutls_priority_t gnutls_assert (); return GNUTLS_E_MEMORY_ERROR; } + + /* for now unsafe renegotiation is default on everyone. To be removed + * when we make it the default. + */ + (*priority_cache)->sr = SR_PARTIAL; if (priorities == NULL) priorities = "NORMAL"; @@ -520,7 +541,7 @@ gnutls_priority_init (gnutls_priority_t if (darg == NULL) { gnutls_assert (); - return GNUTLS_E_MEMORY_ERROR; + goto error; } break_comma_list (darg, broken_list, &broken_list_size, MAX_ELEMENTS, ':'); @@ -610,6 +631,25 @@ gnutls_priority_init (gnutls_priority_t GNUTLS_CRT_UNKNOWN) fn (&(*priority_cache)->cert_type, algo); } /* now check if the element is something like -ALGO */ + else if (strcasecmp (&broken_list[i][1], + "UNSAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_UNSAFE; + } + else if (strcasecmp (&broken_list[i][1], "SAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_SAFE; + } + else if (strcasecmp (&broken_list[i][1], + "PARTIAL_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_PARTIAL; + } + else if (strcasecmp (&broken_list[i][1], + "DISABLE_SAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_DISABLED; + } else goto error; } @@ -637,6 +677,7 @@ error: } } gnutls_free (darg); + gnutls_free(*priority_cache); return GNUTLS_E_INVALID_REQUEST; Index: gnutls-2.4.1/lib/gnutls_record.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_record.c +++ gnutls-2.4.1/lib/gnutls_record.c @@ -741,10 +741,18 @@ record_check_type (gnutls_session_t sess * If we are a server, a client may initiate a renegotiation at any time. */ if (session->security_parameters.entity == GNUTLS_SERVER) - { - gnutls_assert (); - return GNUTLS_E_REHANDSHAKE; - } + { + gnutls_assert (); + ret = + _gnutls_record_buffer_put (recv_type, session, (void *) data, + data_size); + if (ret < 0) + { + gnutls_assert (); + return ret; + } + return GNUTLS_E_REHANDSHAKE; + } /* If we are already in a handshake then a Hello * Request is illegal. But here we don't really care @@ -896,9 +904,13 @@ begin: _gnutls_io_read_buffered (session, &headers, header_size, -1)) != header_size) { + _gnutls_handshake_log ("XXX[]: ret: %d %s\n", ret, gnutls_strerror(ret)); + if (ret < 0 && gnutls_error_is_fatal (ret) == 0) return ret; + _gnutls_handshake_log ("XXX2[]: ret: %d %s\n", ret, gnutls_strerror(ret)); + session_invalidate (session); if (type == GNUTLS_ALERT) { Index: gnutls-2.4.1/lib/gnutls_state.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_state.c +++ gnutls-2.4.1/lib/gnutls_state.c @@ -214,6 +214,7 @@ _gnutls_handshake_internal_state_clear ( session->internals.adv_version_minor = 0; session->internals.adv_version_minor = 0; session->internals.direction = 0; + session->internals.safe_renegotiation_received = 0; /* use out of band data for the last * handshake messages received. @@ -330,6 +331,11 @@ gnutls_init (gnutls_session_t * session, _gnutls_handshake_internal_state_clear (*session); + /* emulate old gnutls behavior for old applications that do not use the priority_* + * functions. + */ + (*session)->internals.priorities.sr = SR_PARTIAL; + return 0; } Index: gnutls-2.4.1/src/cli-gaa.c =================================================================== --- gnutls-2.4.1.orig/src/cli-gaa.c +++ gnutls-2.4.1/src/cli-gaa.c @@ -129,6 +129,7 @@ void gaa_help(void) printf("GNU TLS test client\nUsage: gnutls-cli [options] hostname\n\n\n"); __gaa_helpsingle('d', "debug", "integer ", "Enable debugging"); __gaa_helpsingle('r', "resume", "", "Connect, establish a session. Connect again and resume this session."); + __gaa_helpsingle('e', "rehandshake", "", "Connect, establish a session and rehandshake immediately."); __gaa_helpsingle('s', "starttls", "", "Connect, establish a plain session and start TLS when EOF or a SIGALRM is received."); __gaa_helpsingle(0, "crlf", "", "Send CR LF instead of LF."); __gaa_helpsingle(0, "x509fmtder", "", "Use DER format for certificates to read from."); @@ -251,6 +252,8 @@ struct _gaainfo int crlf; #line 20 "cli.gaa" int starttls; +#line 20 "cli.gaa" + int rehandshake; #line 17 "cli.gaa" int resume; #line 14 "cli.gaa" @@ -309,7 +312,7 @@ static int gaa_error = 0; #define GAA_MULTIPLE_OPTION 3 #define GAA_REST 0 -#define GAA_NB_OPTION 36 +#define GAA_NB_OPTION 37 #define GAAOPTID_copyright 1 #define GAAOPTID_version 2 #define GAAOPTID_help 3 @@ -344,8 +347,9 @@ static int gaa_error = 0; #define GAAOPTID_x509fmtder 32 #define GAAOPTID_crlf 33 #define GAAOPTID_starttls 34 -#define GAAOPTID_resume 35 -#define GAAOPTID_debug 36 +#define GAAOPTID_rehandshake 35 +#define GAAOPTID_resume 36 +#define GAAOPTID_debug 37 #line 168 "gaa.skel" @@ -743,6 +747,7 @@ static int gaa_get_option_num(char *str, GAA_CHECK1STR("", GAAOPTID_x509fmtder); GAA_CHECK1STR("", GAAOPTID_crlf); GAA_CHECK1STR("s", GAAOPTID_starttls); + GAA_CHECK1STR("e", GAAOPTID_rehandshake); GAA_CHECK1STR("r", GAAOPTID_resume); #line 277 "gaa.skel" @@ -782,6 +787,7 @@ static int gaa_get_option_num(char *str, GAA_CHECKSTR("x509fmtder", GAAOPTID_x509fmtder); GAA_CHECKSTR("crlf", GAAOPTID_crlf); GAA_CHECKSTR("starttls", GAAOPTID_starttls); + GAA_CHECKSTR("rehandshake", GAAOPTID_rehandshake); GAA_CHECKSTR("resume", GAAOPTID_resume); GAA_CHECKSTR("debug", GAAOPTID_debug); @@ -1131,6 +1137,13 @@ static int gaa_try(int gaa_num, int gaa_ return GAA_OK; break; + case GAAOPTID_rehandshake: + OK = 0; +#line 21 "cli.gaa" +{ gaaval->rehandshake = 1 ;}; + + return GAA_OK; + break; case GAAOPTID_resume: OK = 0; #line 18 "cli.gaa" @@ -1191,7 +1204,7 @@ int gaa(int argc, char **argv, gaainfo * gaaval->srp_username=NULL; gaaval->srp_passwd=NULL; gaaval->fmtder = 0; gaaval->starttls =0; gaaval->debug = 0; gaaval->print_cert = 0; gaaval->verbose = 0; gaaval->psk_key = NULL; gaaval->psk_username = NULL; gaaval->priorities = NULL; - gaaval->opaque_prf_input = NULL; gaaval->pgp_subkey = NULL; ;}; + gaaval->opaque_prf_input = NULL; gaaval->pgp_subkey = NULL; gaaval->rehandshake = 0; ;}; } inited = 1; Index: gnutls-2.4.1/src/cli-gaa.h =================================================================== --- gnutls-2.4.1.orig/src/cli-gaa.h +++ gnutls-2.4.1/src/cli-gaa.h @@ -82,6 +82,7 @@ struct _gaainfo int crlf; #line 20 "cli.gaa" int starttls; + int rehandshake; #line 17 "cli.gaa" int resume; #line 14 "cli.gaa" Index: gnutls-2.4.1/src/cli.c =================================================================== --- gnutls-2.4.1.orig/src/cli.c +++ gnutls-2.4.1/src/cli.c @@ -55,7 +55,7 @@ int _win_select(int max_fd, fd_set * rfd #define MAX_BUF 4096 /* global stuff here */ -int resume, starttls, insecure; +int resume, starttls, insecure, rehandshake; char *hostname = NULL; char *service; int record_max_size; @@ -672,6 +672,23 @@ after_handshake: programs to search for when gnutls-cli has reached this point. */ printf ("\n- Simple Client Mode:\n\n"); + if (rehandshake) + { + ret = do_handshake (&hd); + + if (ret < 0) + { + fprintf (stderr, "*** ReHandshake has failed\n"); + gnutls_perror (ret); + gnutls_deinit (hd.session); + return 1; + } + else + { + printf ("- ReHandshake was completed\n"); + } + } + #ifndef _WIN32 signal (SIGALRM, &starttls_alarm); #endif @@ -833,6 +850,7 @@ gaa_parser (int argc, char **argv) print_cert = info.print_cert; starttls = info.starttls; resume = info.resume; + rehandshake = info.rehandshake; insecure = info.insecure; service = info.port; record_max_size = info.record_size; @@ -953,6 +971,11 @@ do_handshake (socket_st * socket) socket->secure = 1; } + else + { + gnutls_alert_send_appropriate(socket->session, ret); + shutdown (socket->fd, SHUT_RDWR); + } return ret; } Index: gnutls-2.4.1/src/cli.gaa =================================================================== --- gnutls-2.4.1.orig/src/cli.gaa +++ gnutls-2.4.1/src/cli.gaa @@ -17,6 +17,9 @@ option (d, debug) INT "integer" { $debug #int resume; option (r, resume) { $resume = 1 } "Connect, establish a session. Connect again and resume this session." +#int rehandshake; +option (e, rehandshake) { $rehandshake = 1 } "Connect, establish a session and rehandshake immediately." + #int starttls; option (s, starttls) { $starttls = 1 } "Connect, establish a plain session and start TLS when EOF or a SIGALRM is received." @@ -131,4 +134,4 @@ init { $resume=0; $port="443"; $rest_arg $srp_username=NULL; $srp_passwd=NULL; $fmtder = 0; $starttls =0; $debug = 0; $print_cert = 0; $verbose = 0; $psk_key = NULL; $psk_username = NULL; $priorities = NULL; - $opaque_prf_input = NULL; $pgp_subkey = NULL; } + $opaque_prf_input = NULL; $pgp_subkey = NULL; $rehandshake = 0; } Index: gnutls-2.4.1/src/serv.c =================================================================== --- gnutls-2.4.1.orig/src/serv.c +++ gnutls-2.4.1/src/serv.c @@ -730,6 +730,18 @@ get_response (gnutls_session_t session, } else { + fprintf(stderr, "received: %s\n", request); + if (request[0] == request[1] && request[0] == '*') + { + if (strncmp(request, "**REHANDSHAKE**", sizeof("**REHANDSHAKE**")-1)==0) + { + fprintf(stderr, "*** Sending rehandshake request\n"); + gnutls_rehandshake(session); + } + *response = NULL; + *response_length = 0; + return; + } *response = strdup (request); *response_length = ((*response) ? strlen (*response) : 0); } @@ -1139,7 +1151,7 @@ main (int argc, char **argv) ret = gnutls_alert_send_appropriate (j->tls_session, r); } - while (ret == GNUTLS_E_AGAIN); + while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); j->http_state = HTTP_STATE_CLOSING; } else if (r == 0) @@ -1170,14 +1182,37 @@ main (int argc, char **argv) } else if (r <= 0) { - j->http_state = HTTP_STATE_CLOSING; - if (r < 0 && r != GNUTLS_E_UNEXPECTED_PACKET_LENGTH) + if (r == GNUTLS_E_REHANDSHAKE) { - check_alert (j->tls_session, r); - fprintf (stderr, "Error while receiving data\n"); - GERR (r); + fprintf(stderr, "*** Received hello message\n"); + do + { + r = gnutls_handshake (j->tls_session); + } + while (r == GNUTLS_E_INTERRUPTED || r == GNUTLS_E_AGAIN); + if (r < 0) + { + + do + { + ret = gnutls_alert_send_appropriate (j->tls_session, r); + } + while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); + + GERR (r); + j->http_state = HTTP_STATE_CLOSING; + } } - + else + { + j->http_state = HTTP_STATE_CLOSING; + if (r < 0 && r != GNUTLS_E_UNEXPECTED_PACKET_LENGTH) + { + check_alert (j->tls_session, r); + fprintf (stderr, "Error while receiving data\n"); + GERR (r); + } + } } else { @@ -1257,7 +1292,7 @@ main (int argc, char **argv) } } - if (j->handshake_ok == 1) + if (j->handshake_ok == 1 && j->http_response != NULL) { /* FIXME if j->http_response == NULL? */ r = gnutls_record_send (j->tls_session, @@ -1309,6 +1344,12 @@ main (int argc, char **argv) } } } + else + { + j->request_length = 0; + j->http_request[0] = 0; + j->http_state = HTTP_STATE_REQUEST; + } } } lloopend (listener_list, j); Index: gnutls-2.4.1/src/tests.c =================================================================== --- gnutls-2.4.1.orig/src/tests.c +++ gnutls-2.4.1/src/tests.c @@ -45,6 +45,7 @@ extern int verbose; int tls1_ok = 0; int ssl3_ok = 0; int tls1_1_ok = 0; +int tls1_2_ok = 0; /* keep session info */ static char *session_data = NULL; @@ -103,156 +104,32 @@ do_handshake (gnutls_session_t session) return TEST_SUCCEED; } -static int protocol_priority[16] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 }; +char protocol_str[] = "+VERS-TLS1.0:+VERS-SSL3.0"; +char prio_str[256] = ""; static const int kx_priority[16] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, GNUTLS_KX_ANON_DH, GNUTLS_KX_RSA_EXPORT, 0 }; -static const int cipher_priority[16] = - { GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, - GNUTLS_CIPHER_ARCFOUR_40, 0 -}; -static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 }; -static const int mac_priority[16] = { GNUTLS_MAC_SHA1, GNUTLS_MAC_MD5, 0 }; -static const int cert_type_priority[16] = { GNUTLS_CRT_X509, 0 }; - -#define ADD_ALL_CIPHERS(session) gnutls_cipher_set_priority(session, cipher_priority) -#define ADD_ALL_COMP(session) gnutls_compression_set_priority(session, comp_priority) -#define ADD_ALL_MACS(session) gnutls_mac_set_priority(session, mac_priority) -#define ADD_ALL_KX(session) gnutls_kx_set_priority(session, kx_priority) -#define ADD_ALL_PROTOCOLS(session) gnutls_protocol_set_priority(session, protocol_priority) -#define ADD_ALL_CERTTYPES(session) gnutls_certificate_type_set_priority(session, cert_type_priority) - -static void -ADD_KX (gnutls_session_t session, int kx) -{ - static int _kx_priority[] = { 0, 0 }; - _kx_priority[0] = kx; - - gnutls_kx_set_priority (session, _kx_priority); -} - -static void -ADD_KX2 (gnutls_session_t session, int kx1, int kx2) -{ - static int _kx_priority[] = { 0, 0, 0 }; - _kx_priority[0] = kx1; - _kx_priority[1] = kx2; - - gnutls_kx_set_priority (session, _kx_priority); -} - -static void -ADD_CIPHER (gnutls_session_t session, int cipher) -{ - static int _cipher_priority[] = { 0, 0 }; - _cipher_priority[0] = cipher; - - gnutls_cipher_set_priority (session, _cipher_priority); -} - -static void -ADD_CIPHER4 (gnutls_session_t session, int cipher1, int cipher2, int cipher3, - int cipher4) -{ - static int _cipher_priority[] = { 0, 0, 0, 0, 0 }; - _cipher_priority[0] = cipher1; - _cipher_priority[1] = cipher2; - _cipher_priority[2] = cipher3; - _cipher_priority[3] = cipher4; - - gnutls_cipher_set_priority (session, _cipher_priority); -} - -static void -ADD_MAC (gnutls_session_t session, int mac) -{ - static int _mac_priority[] = { 0, 0 }; - _mac_priority[0] = mac; - - gnutls_mac_set_priority (session, _mac_priority); -} - -static void -ADD_COMP (gnutls_session_t session, int c) -{ - static int _comp_priority[] = { 0, 0 }; - _comp_priority[0] = c; - - gnutls_compression_set_priority (session, _comp_priority); -} - -static void -ADD_CERTTYPE (gnutls_session_t session, int ctype) -{ - static int _ct_priority[] = { 0, 0 }; - _ct_priority[0] = ctype; - - gnutls_certificate_type_set_priority (session, _ct_priority); -} - -static void -ADD_PROTOCOL (gnutls_session_t session, int protocol) -{ - static int _proto_priority[] = { 0, 0 }; - _proto_priority[0] = protocol; - - gnutls_protocol_set_priority (session, _proto_priority); -} +#define ALL_CIPHERS "+3DES-CBC:+ARCFOUR-128:+ARCFOUR-40" +#define ALL_COMP "+COMP-NULL" +#define ALL_MACS "+SHA1:+MD5" +#define ALL_CERTTYPES "+CTYPE-X509" +#define REST "%%UNSAFE_RENEGOTIATION" +#define ALL_KX "+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+RSA-EXPORT" +#define INIT_STR "NONE:" -static void -ADD_PROTOCOL3 (gnutls_session_t session, int p1, int p2, int p3) +static inline void _gnutls_priority_set_direct(gnutls_session_t session, const char* str) { - static int _proto_priority[] = { 0, 0, 0, 0 }; - _proto_priority[0] = p1; - _proto_priority[1] = p2; - _proto_priority[2] = p3; - - gnutls_protocol_set_priority (session, _proto_priority); -} - -#ifdef ENABLE_SRP -static int srp_detected; + const char* err; + int ret = gnutls_priority_set_direct(session, str, &err); -int -_test_srp_username_callback (gnutls_session_t session, - char **username, char **password) -{ - srp_detected = 1; - - return -1; -} - -test_code_t -test_srp (gnutls_session_t session) -{ - int ret; - - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - - ADD_KX (session, GNUTLS_KX_SRP); - srp_detected = 0; - - gnutls_srp_set_client_credentials_function (srp_cred, - _test_srp_username_callback); - - gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred); - - ret = do_handshake (session); - - gnutls_srp_set_client_credentials_function (srp_cred, NULL); - - if (srp_detected != 0) - return TEST_SUCCEED; - else - return TEST_FAILED; + if (ret < 0) + { + fprintf(stderr, "Error in %s\n", err); + exit(1); + } } -#endif test_code_t test_server (gnutls_session_t session) @@ -267,12 +144,8 @@ test_server (gnutls_session_t session) buf[sizeof (buf) - 1] = 0; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); @@ -316,10 +189,8 @@ test_export (gnutls_session_t session) { int ret; - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); + sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); ADD_KX (session, GNUTLS_KX_RSA_EXPORT); ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40); @@ -346,13 +217,9 @@ test_export_info (gnutls_session_t sessi if (verbose == 0 || export_true == 0) return TEST_IGNORE; - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); + sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); - ADD_KX (session, GNUTLS_KX_RSA_EXPORT); - ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -393,13 +260,9 @@ test_dhe (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+DHE-RSA:+DHE-DSS:"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); - ADD_KX2 (session, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -410,6 +273,36 @@ test_dhe (gnutls_session_t session) } test_code_t +test_safe_renegotiation (gnutls_session_t session) +{ + int ret; + + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":%%SAFE_RENEGOTIATION", protocol_str); + _gnutls_priority_set_direct (session, prio_str); + + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); + + ret = do_handshake (session); + + return ret; +} + +test_code_t +test_safe_renegotiation_scsv (gnutls_session_t session) +{ + int ret; + + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-SSL3.0:"ALL_MACS":"ALL_KX":%%SAFE_RENEGOTIATION"); + _gnutls_priority_set_direct (session, prio_str); + + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); + + ret = do_handshake (session); + + return ret; +} + +test_code_t test_dhe_group (gnutls_session_t session) { int ret, ret2; @@ -419,13 +312,8 @@ test_dhe_group (gnutls_session_t session if (verbose == 0 || pubkey.data == NULL) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+DHE-RSA:+DHE-DSS:"REST, protocol_str); - ADD_KX2 (session, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -461,12 +349,9 @@ test_code_t test_ssl3 (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_PROTOCOL (session, GNUTLS_SSL3); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-SSL3.0:"ALL_MACS":"ALL_KX":"REST); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -494,12 +379,9 @@ test_bye (gnutls_session_t session) signal (SIGALRM, got_alarm); #endif - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -546,12 +428,10 @@ test_code_t test_aes (gnutls_session_t session) { int ret; - ADD_CIPHER (session, GNUTLS_CIPHER_AES_128_CBC); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST , protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -563,12 +443,10 @@ test_code_t test_camellia (gnutls_session_t session) { int ret; - ADD_CIPHER (session, GNUTLS_CIPHER_CAMELLIA_128_CBC); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+CAMELLIA-128-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -580,12 +458,10 @@ test_code_t test_openpgp1 (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_CERTTYPE (session, GNUTLS_CRT_OPENPGP); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":+CTYPE-OPENPGP:%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -603,17 +479,12 @@ test_unknown_ciphersuites (gnutls_sessio { int ret; #ifdef ENABLE_CAMELLIA - ADD_CIPHER4 (session, GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_3DES_CBC, - GNUTLS_CIPHER_CAMELLIA_128_CBC, GNUTLS_CIPHER_ARCFOUR_128); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); #else - ADD_CIPHER4 (session, GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_3DES_CBC, - GNUTLS_CIPHER_ARCFOUR_128, 0); + sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); #endif - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -624,12 +495,10 @@ test_code_t test_md5 (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_MAC (session, GNUTLS_MAC_MD5); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:+MD5:"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -641,12 +510,10 @@ test_code_t test_zlib (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_COMP (session, GNUTLS_COMP_ZLIB); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":+COMP-ZLIB:"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -655,17 +522,11 @@ test_zlib (gnutls_session_t session) #endif test_code_t -test_lzo (gnutls_session_t session) +test_sha (gnutls_session_t session) { int ret; - gnutls_handshake_set_private_extensions (session, 1); - - ADD_ALL_CIPHERS (session); - ADD_COMP (session, GNUTLS_COMP_LZO); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:+SHA1:"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -674,15 +535,12 @@ test_lzo (gnutls_session_t session) } test_code_t -test_sha (gnutls_session_t session) +test_3des (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_MAC (session, GNUTLS_MAC_SHA1); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+3DES-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -690,15 +548,12 @@ test_sha (gnutls_session_t session) } test_code_t -test_3des (gnutls_session_t session) +test_arcfour (gnutls_session_t session) { int ret; - ADD_CIPHER (session, GNUTLS_CIPHER_3DES_CBC); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+ARCFOUR-128:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -706,15 +561,13 @@ test_3des (gnutls_session_t session) } test_code_t -test_arcfour (gnutls_session_t session) +test_arcfour_40 (gnutls_session_t session) { int ret; - ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_128); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR "+ARCFOUR-40:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":""+RSA-EXPORT"":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -722,15 +575,13 @@ test_arcfour (gnutls_session_t session) } test_code_t -test_arcfour_40 (gnutls_session_t session) +test_tls1 (gnutls_session_t session) { int ret; - ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.0:"ALL_MACS":"ALL_KX":"REST); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -738,20 +589,18 @@ test_arcfour_40 (gnutls_session_t sessio } test_code_t -test_tls1 (gnutls_session_t session) +test_tls1_2 (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_PROTOCOL (session, GNUTLS_TLS1); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.2:"ALL_MACS":"ALL_KX":"REST); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); if (ret == TEST_SUCCEED) - tls1_ok = 1; + tls1_2_ok = 1; return ret; @@ -761,12 +610,10 @@ test_code_t test_tls1_1 (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_PROTOCOL (session, GNUTLS_TLS1_1); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.1:"ALL_MACS":"ALL_KX":"REST); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -784,12 +631,9 @@ test_tls1_1_fallback (gnutls_session_t s if (tls1_1_ok) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_PROTOCOL3 (session, GNUTLS_TLS1_1, GNUTLS_TLS1, GNUTLS_SSL3); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:"ALL_MACS":"ALL_KX":"REST); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -815,12 +659,9 @@ test_tls_disable (gnutls_session_t sessi if (tls1_ok != 0) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); + gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -829,8 +670,7 @@ test_tls_disable (gnutls_session_t sessi /* disable TLS 1.0 */ if (ssl3_ok != 0) { - protocol_priority[0] = GNUTLS_SSL3; - protocol_priority[1] = 0; + strcpy(protocol_str, "+VERS-SSL3.0"); } } return ret; @@ -847,12 +687,8 @@ test_rsa_pms (gnutls_session_t session) * If the server is old, buggy and only supports * SSL 3.0 then the handshake will fail. */ - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_KX (session, GNUTLS_KX_RSA); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+RSA:"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); @@ -868,12 +704,8 @@ test_code_t test_max_record_size (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); gnutls_record_set_max_size (session, 512); @@ -892,12 +724,9 @@ test_code_t test_hello_extension (gnutls_session_t session) { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); gnutls_record_set_max_size (session, 512); @@ -923,12 +752,8 @@ test_version_rollback (gnutls_session_t * attacks which allow a version downgrade) and this * connection will fail. */ - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); _gnutls_record_set_default_version (session, 3, 0); @@ -953,12 +778,8 @@ test_version_oob (gnutls_session_t sessi /* here we enable both SSL 3.0 and TLS 1.0 * and we connect using a 5.5 record version. */ - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); _gnutls_record_set_default_version (session, 5, 5); @@ -978,12 +799,8 @@ test_rsa_pms_version_check (gnutls_sessi * * A normal server would abort this handshake. */ - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); _gnutls_rsa_pms_set_version (session, 5, 5); /* use SSL 5.5 version */ @@ -998,12 +815,8 @@ test_anonymous (gnutls_session_t session { int ret; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_KX (session, GNUTLS_KX_ANON_DH); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+ANON-DH:"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred); ret = do_handshake (session); @@ -1025,12 +838,8 @@ test_session_resume2 (gnutls_session_t s if (session == NULL) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred); @@ -1072,12 +881,8 @@ test_certificate (gnutls_session_t sessi if (verbose == 0) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); @@ -1141,12 +946,8 @@ test_server_cas (gnutls_session_t sessio if (verbose == 0) return TEST_IGNORE; - ADD_ALL_CIPHERS (session); - ADD_ALL_COMP (session); - ADD_ALL_CERTTYPES (session); - ADD_ALL_PROTOCOLS (session); - ADD_ALL_MACS (session); - ADD_ALL_KX (session); + sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); + _gnutls_priority_set_direct (session, prio_str); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); gnutls_certificate_client_set_retrieve_function (xcred, cert_callback); Index: gnutls-2.4.1/src/tests.h =================================================================== --- gnutls-2.4.1.orig/src/tests.h +++ gnutls-2.4.1/src/tests.h @@ -3,7 +3,6 @@ typedef enum TEST_SUCCEED, TEST_FAILED, TEST_UNSURE, TEST_IGNORE } test_code_t; -test_code_t test_srp (gnutls_session_t state); test_code_t test_server (gnutls_session_t state); test_code_t test_export (gnutls_session_t state); test_code_t test_export_info (gnutls_session_t state); @@ -21,7 +20,10 @@ test_code_t test_3des (gnutls_session_t test_code_t test_arcfour (gnutls_session_t state); test_code_t test_arcfour_40 (gnutls_session_t state); test_code_t test_tls1 (gnutls_session_t state); +test_code_t test_safe_renegotiation (gnutls_session_t state); +test_code_t test_safe_renegotiation_scsv (gnutls_session_t state); test_code_t test_tls1_1 (gnutls_session_t state); +test_code_t test_tls1_2 (gnutls_session_t state); test_code_t test_tls1_1_fallback (gnutls_session_t state); test_code_t test_tls_disable (gnutls_session_t state); test_code_t test_rsa_pms (gnutls_session_t state); @@ -37,6 +39,5 @@ test_code_t test_session_resume2 (gnutls test_code_t test_rsa_pms_version_check (gnutls_session_t session); test_code_t test_version_oob (gnutls_session_t session); test_code_t test_zlib (gnutls_session_t session); -test_code_t test_lzo (gnutls_session_t session); int _test_srp_username_callback (gnutls_session_t session, char **username, char **password); Index: gnutls-2.4.1/src/tls_test.c =================================================================== --- gnutls-2.4.1.orig/src/tls_test.c +++ gnutls-2.4.1/src/tls_test.c @@ -75,6 +75,9 @@ typedef struct } TLS_TEST; static const TLS_TEST tls_tests[] = { + {"for Safe renegotiation support", test_safe_renegotiation, "yes", "no", "dunno"}, + {"for Safe renegotiation support (SCSV)", test_safe_renegotiation_scsv, "yes", "no", "dunno"}, + {"for TLS 1.2 support", test_tls1_2, "yes", "no", "dunno"}, {"for TLS 1.1 support", test_tls1_1, "yes", "no", "dunno"}, {"fallback from TLS 1.1 to", test_tls1_1_fallback, "TLS 1.0", "failed", "SSL 3.0"}, @@ -135,14 +138,8 @@ static const TLS_TEST tls_tests[] = { {"for ZLIB compression support (TLS extension)", test_zlib, "yes", "no", "dunno"}, #endif - {"for LZO compression support (GnuTLS extension)", test_lzo, "yes", - "no", "dunno"}, {"for max record size (TLS extension)", test_max_record_size, "yes", "no", "dunno"}, -#ifdef ENABLE_SRP - {"for SRP authentication support (TLS extension)", test_srp, "yes", - "no", "dunno"}, -#endif {"for OpenPGP authentication support (TLS extension)", test_openpgp1, "yes", "no", "dunno"}, {NULL, NULL, NULL, NULL, NULL} @@ -228,7 +225,7 @@ main (int argc, char **argv) /* if neither of SSL3 and TLSv1 are supported, exit */ - if (i > 3 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0) + if (i > 6 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0) { fprintf (stderr, "\nServer does not support any of SSL 3.0, TLS 1.0 and TLS 1.1\n"); Index: gnutls-2.4.1/tests/Makefile.am =================================================================== --- gnutls-2.4.1.orig/tests/Makefile.am +++ gnutls-2.4.1/tests/Makefile.am @@ -20,7 +20,7 @@ # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode pkcs12-decode \ - userid pathlen key-id sha2 hostname-check + userid pathlen key-id sha2 hostname-check safe-renegotiation if ENABLE_OPENPGP SUBDIRS += openpgp openpgp-certs Index: gnutls-2.4.1/tests/Makefile.in =================================================================== --- gnutls-2.4.1.orig/tests/Makefile.in +++ gnutls-2.4.1/tests/Makefile.in @@ -299,7 +299,7 @@ ETAGS = etags CTAGS = ctags DIST_SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode \ pkcs12-decode userid pathlen key-id sha2 hostname-check \ - openpgp openpgp-certs + openpgp openpgp-certs safe-renegotiation DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ @@ -705,7 +705,7 @@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode pkcs12-decode \ - userid pathlen key-id sha2 hostname-check $(am__append_1) + userid pathlen key-id sha2 safe-renegotiation hostname-check $(am__append_1) EXTRA_DIST = libgcrypt.supp AM_CPPFLAGS = -I$(top_srcdir)/lgl -I$(top_builddir)/lgl \ -I$(top_srcdir)/gl -I$(top_builddir)/gl \ Index: gnutls-2.4.1/tests/resume.c =================================================================== --- gnutls-2.4.1.orig/tests/resume.c +++ gnutls-2.4.1/tests/resume.c @@ -45,6 +45,9 @@ static int wrap_db_store (void *dbf, gnu static gnutls_datum_t wrap_db_fetch (void *dbf, gnutls_datum_t key); static int wrap_db_delete (void *dbf, gnutls_datum_t key); +pid_t child; + + #define TLS_SESSION_CACHE 50 /* A very basic TLS client, with anonymous authentication. @@ -52,6 +55,12 @@ static int wrap_db_delete (void *dbf, gn #define MAX_BUF 1024 #define MSG "Hello TLS" +static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "%s |<%d>| %s", child ? "server" : "client", level, str); +} + /* Connects to the peer and returns a socket * descriptor. @@ -106,6 +115,11 @@ client (void) */ int t; gnutls_datum session_data; + if (debug) + { + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (2); + } gnutls_global_init (); @@ -333,6 +347,12 @@ server (void) { /* this must be called once in the program, it is mostly for the server. */ + if (debug) + { + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (2); + } + gnutls_global_init (); gnutls_anon_allocate_server_credentials (&anoncred); @@ -422,8 +442,6 @@ server (void) void doit (void) { - pid_t child; - global_start (); if (error_count) return; Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.am =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.am @@ -0,0 +1,37 @@ +## Process this file with automake to produce Makefile.in +# Copyright (C) 2010 Free Software Foundation, Inc. +# +# This file is part of GnuTLS. +# +# This file is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This file is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this file; if not, write to the Free Software Foundation, +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS) +AM_CPPFLAGS = \ + -I$(top_srcdir)/lib/includes \ + -I$(top_builddir)/lib/includes + +AM_LDFLAGS = -no-install +LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) + +ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7 + +check_PROGRAMS = $(ctests) +TESTS = $(ctests) +TESTS_ENVIRONMENT = $(VALGRIND) + +EXTRA_DIST = README params.dh + +dist_check_SCRIPTS = testsrn +#TESTS = testsrn Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in @@ -0,0 +1,1299 @@ +# Makefile.in generated by automake 1.11.1 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, +# Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +# Copyright (C) 2010 Free Software Foundation, Inc. +# +# This file is part of GnuTLS. +# +# This file is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This file is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this file; if not, write to the Free Software Foundation, +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +VPATH = @srcdir@ +pkgdatadir = $(datadir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkglibexecdir = $(libexecdir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +check_PROGRAMS = $(am__EXEEXT_1) +TESTS = $(am__EXEEXT_1) +subdir = tests/safe-renegotiation +DIST_COMMON = README $(dist_check_SCRIPTS) $(srcdir)/Makefile.am \ + $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/libextra/m4/hooks.m4 \ + $(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \ + $(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \ + $(top_srcdir)/gl/m4/arpa_inet_h.m4 \ + $(top_srcdir)/gl/m4/asm-underscore.m4 \ + $(top_srcdir)/gl/m4/autobuild.m4 \ + $(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \ + $(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \ + $(top_srcdir)/gl/m4/extensions.m4 \ + $(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \ + $(top_srcdir)/gl/m4/fseeko.m4 \ + $(top_srcdir)/gl/m4/getaddrinfo.m4 \ + $(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \ + $(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \ + $(top_srcdir)/gl/m4/gettimeofday.m4 \ + $(top_srcdir)/gl/m4/gnulib-common.m4 \ + $(top_srcdir)/gl/m4/gnulib-comp.m4 \ + $(top_srcdir)/gl/m4/hostent.m4 \ + $(top_srcdir)/gl/m4/include_next.m4 \ + $(top_srcdir)/gl/m4/inet_ntop.m4 \ + $(top_srcdir)/gl/m4/inet_pton.m4 \ + $(top_srcdir)/gl/m4/intmax_t.m4 \ + $(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \ + $(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \ + $(top_srcdir)/gl/m4/lib-prefix.m4 \ + $(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \ + $(top_srcdir)/gl/m4/malloc.m4 \ + $(top_srcdir)/gl/m4/manywarnings.m4 \ + $(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \ + $(top_srcdir)/gl/m4/mmap-anon.m4 \ + $(top_srcdir)/gl/m4/multiarch.m4 \ + $(top_srcdir)/gl/m4/netdb_h.m4 \ + $(top_srcdir)/gl/m4/netinet_in_h.m4 \ + $(top_srcdir)/gl/m4/onceonly_2_57.m4 \ + $(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \ + $(top_srcdir)/gl/m4/read-file.m4 \ + $(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \ + $(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \ + $(top_srcdir)/gl/m4/size_max.m4 \ + $(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \ + $(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \ + $(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \ + $(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \ + $(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \ + $(top_srcdir)/gl/m4/stdlib_h.m4 \ + $(top_srcdir)/gl/m4/strerror.m4 \ + $(top_srcdir)/gl/m4/string_h.m4 \ + $(top_srcdir)/gl/m4/sys_ioctl_h.m4 \ + $(top_srcdir)/gl/m4/sys_select_h.m4 \ + $(top_srcdir)/gl/m4/sys_socket_h.m4 \ + $(top_srcdir)/gl/m4/sys_stat_h.m4 \ + $(top_srcdir)/gl/m4/sys_time_h.m4 \ + $(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \ + $(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \ + $(top_srcdir)/gl/m4/valgrind-tests.m4 \ + $(top_srcdir)/gl/m4/vasnprintf.m4 \ + $(top_srcdir)/gl/m4/version-etc.m4 \ + $(top_srcdir)/gl/m4/warn-on-use.m4 \ + $(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \ + $(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \ + $(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \ + $(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \ + $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ + $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ + $(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +CONFIG_CLEAN_VPATH_FILES = +am__EXEEXT_1 = srn0$(EXEEXT) srn1$(EXEEXT) srn2$(EXEEXT) srn3$(EXEEXT) \ + srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT) +srn0_SOURCES = srn0.c +srn0_OBJECTS = srn0.$(OBJEXT) +srn0_LDADD = $(LDADD) +am__DEPENDENCIES_1 = +srn0_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn1_SOURCES = srn1.c +srn1_OBJECTS = srn1.$(OBJEXT) +srn1_LDADD = $(LDADD) +srn1_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn2_SOURCES = srn2.c +srn2_OBJECTS = srn2.$(OBJEXT) +srn2_LDADD = $(LDADD) +srn2_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn3_SOURCES = srn3.c +srn3_OBJECTS = srn3.$(OBJEXT) +srn3_LDADD = $(LDADD) +srn3_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn4_SOURCES = srn4.c +srn4_OBJECTS = srn4.$(OBJEXT) +srn4_LDADD = $(LDADD) +srn4_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn5_SOURCES = srn5.c +srn5_OBJECTS = srn5.$(OBJEXT) +srn5_LDADD = $(LDADD) +srn5_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn6_SOURCES = srn6.c +srn6_OBJECTS = srn6.$(OBJEXT) +srn6_LDADD = $(LDADD) +srn6_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +srn7_SOURCES = srn7.c +srn7_OBJECTS = srn7.$(OBJEXT) +srn7_LDADD = $(LDADD) +srn7_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ + $(am__DEPENDENCIES_1) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp +am__depfiles_maybe = depfiles +am__mv = mv -f +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ + $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +CCLD = $(CC) +LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ + --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ + $(LDFLAGS) -o $@ +SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c +DIST_SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c +ETAGS = etags +CTAGS = ctags +am__tty_colors = \ + red=; grn=; lgn=; blu=; std= +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +ALLOCA = @ALLOCA@ +ALLOCA_H = @ALLOCA_H@ +AMTAR = @AMTAR@ +APPLE_UNIVERSAL_BUILD = @APPLE_UNIVERSAL_BUILD@ +AR = @AR@ +AS = @AS@ +ASM_SYMBOL_PREFIX = @ASM_SYMBOL_PREFIX@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BITSIZEOF_PTRDIFF_T = @BITSIZEOF_PTRDIFF_T@ +BITSIZEOF_SIG_ATOMIC_T = @BITSIZEOF_SIG_ATOMIC_T@ +BITSIZEOF_SIZE_T = @BITSIZEOF_SIZE_T@ +BITSIZEOF_WCHAR_T = @BITSIZEOF_WCHAR_T@ +BITSIZEOF_WINT_T = @BITSIZEOF_WINT_T@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CONFIG_INCLUDE = @CONFIG_INCLUDE@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CXX = @CXX@ +CXXCPP = @CXXCPP@ +CXXDEPMODE = @CXXDEPMODE@ +CXXFLAGS = @CXXFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +DLLTOOL = @DLLTOOL@ +DLL_VERSION = @DLL_VERSION@ +DSYMUTIL = @DSYMUTIL@ +DUMPBIN = @DUMPBIN@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EMULTIHOP_HIDDEN = @EMULTIHOP_HIDDEN@ +EMULTIHOP_VALUE = @EMULTIHOP_VALUE@ +ENOLINK_HIDDEN = @ENOLINK_HIDDEN@ +ENOLINK_VALUE = @ENOLINK_VALUE@ +EOVERFLOW_HIDDEN = @EOVERFLOW_HIDDEN@ +EOVERFLOW_VALUE = @EOVERFLOW_VALUE@ +ERRNO_H = @ERRNO_H@ +EXEEXT = @EXEEXT@ +FGREP = @FGREP@ +FLOAT_H = @FLOAT_H@ +GAA = @GAA@ +GETADDRINFO_LIB = @GETADDRINFO_LIB@ +GNULIB_ACCEPT = @GNULIB_ACCEPT@ +GNULIB_ACCEPT4 = @GNULIB_ACCEPT4@ +GNULIB_ATOLL = @GNULIB_ATOLL@ +GNULIB_BIND = @GNULIB_BIND@ +GNULIB_BTOWC = @GNULIB_BTOWC@ +GNULIB_CALLOC_POSIX = @GNULIB_CALLOC_POSIX@ +GNULIB_CANONICALIZE_FILE_NAME = @GNULIB_CANONICALIZE_FILE_NAME@ +GNULIB_CHOWN = @GNULIB_CHOWN@ +GNULIB_CLOSE = @GNULIB_CLOSE@ +GNULIB_CONNECT = @GNULIB_CONNECT@ +GNULIB_DPRINTF = @GNULIB_DPRINTF@ +GNULIB_DUP2 = @GNULIB_DUP2@ +GNULIB_DUP3 = @GNULIB_DUP3@ +GNULIB_ENVIRON = @GNULIB_ENVIRON@ +GNULIB_EUIDACCESS = @GNULIB_EUIDACCESS@ +GNULIB_FACCESSAT = @GNULIB_FACCESSAT@ +GNULIB_FCHDIR = @GNULIB_FCHDIR@ +GNULIB_FCHMODAT = @GNULIB_FCHMODAT@ +GNULIB_FCHOWNAT = @GNULIB_FCHOWNAT@ +GNULIB_FCLOSE = @GNULIB_FCLOSE@ +GNULIB_FFLUSH = @GNULIB_FFLUSH@ +GNULIB_FOPEN = @GNULIB_FOPEN@ +GNULIB_FPRINTF = @GNULIB_FPRINTF@ +GNULIB_FPRINTF_POSIX = @GNULIB_FPRINTF_POSIX@ +GNULIB_FPURGE = @GNULIB_FPURGE@ +GNULIB_FPUTC = @GNULIB_FPUTC@ +GNULIB_FPUTS = @GNULIB_FPUTS@ +GNULIB_FREOPEN = @GNULIB_FREOPEN@ +GNULIB_FSEEK = @GNULIB_FSEEK@ +GNULIB_FSEEKO = @GNULIB_FSEEKO@ +GNULIB_FSTATAT = @GNULIB_FSTATAT@ +GNULIB_FSYNC = @GNULIB_FSYNC@ +GNULIB_FTELL = @GNULIB_FTELL@ +GNULIB_FTELLO = @GNULIB_FTELLO@ +GNULIB_FTRUNCATE = @GNULIB_FTRUNCATE@ +GNULIB_FUTIMENS = @GNULIB_FUTIMENS@ +GNULIB_FWRITE = @GNULIB_FWRITE@ +GNULIB_GETADDRINFO = @GNULIB_GETADDRINFO@ +GNULIB_GETCWD = @GNULIB_GETCWD@ +GNULIB_GETDELIM = @GNULIB_GETDELIM@ +GNULIB_GETDOMAINNAME = @GNULIB_GETDOMAINNAME@ +GNULIB_GETDTABLESIZE = @GNULIB_GETDTABLESIZE@ +GNULIB_GETGROUPS = @GNULIB_GETGROUPS@ +GNULIB_GETHOSTNAME = @GNULIB_GETHOSTNAME@ +GNULIB_GETLINE = @GNULIB_GETLINE@ +GNULIB_GETLOADAVG = @GNULIB_GETLOADAVG@ +GNULIB_GETLOGIN = @GNULIB_GETLOGIN@ +GNULIB_GETLOGIN_R = @GNULIB_GETLOGIN_R@ +GNULIB_GETPAGESIZE = @GNULIB_GETPAGESIZE@ +GNULIB_GETPEERNAME = @GNULIB_GETPEERNAME@ +GNULIB_GETSOCKNAME = @GNULIB_GETSOCKNAME@ +GNULIB_GETSOCKOPT = @GNULIB_GETSOCKOPT@ +GNULIB_GETSUBOPT = @GNULIB_GETSUBOPT@ +GNULIB_GETTIMEOFDAY = @GNULIB_GETTIMEOFDAY@ +GNULIB_GETUSERSHELL = @GNULIB_GETUSERSHELL@ +GNULIB_GRANTPT = @GNULIB_GRANTPT@ +GNULIB_INET_NTOP = @GNULIB_INET_NTOP@ +GNULIB_INET_PTON = @GNULIB_INET_PTON@ +GNULIB_IOCTL = @GNULIB_IOCTL@ +GNULIB_LCHMOD = @GNULIB_LCHMOD@ +GNULIB_LCHOWN = @GNULIB_LCHOWN@ +GNULIB_LINK = @GNULIB_LINK@ +GNULIB_LINKAT = @GNULIB_LINKAT@ +GNULIB_LISTEN = @GNULIB_LISTEN@ +GNULIB_LSEEK = @GNULIB_LSEEK@ +GNULIB_LSTAT = @GNULIB_LSTAT@ +GNULIB_MALLOC_POSIX = @GNULIB_MALLOC_POSIX@ +GNULIB_MBRLEN = @GNULIB_MBRLEN@ +GNULIB_MBRTOWC = @GNULIB_MBRTOWC@ +GNULIB_MBSCASECMP = @GNULIB_MBSCASECMP@ +GNULIB_MBSCASESTR = @GNULIB_MBSCASESTR@ +GNULIB_MBSCHR = @GNULIB_MBSCHR@ +GNULIB_MBSCSPN = @GNULIB_MBSCSPN@ +GNULIB_MBSINIT = @GNULIB_MBSINIT@ +GNULIB_MBSLEN = @GNULIB_MBSLEN@ +GNULIB_MBSNCASECMP = @GNULIB_MBSNCASECMP@ +GNULIB_MBSNLEN = @GNULIB_MBSNLEN@ +GNULIB_MBSNRTOWCS = @GNULIB_MBSNRTOWCS@ +GNULIB_MBSPBRK = @GNULIB_MBSPBRK@ +GNULIB_MBSPCASECMP = @GNULIB_MBSPCASECMP@ +GNULIB_MBSRCHR = @GNULIB_MBSRCHR@ +GNULIB_MBSRTOWCS = @GNULIB_MBSRTOWCS@ +GNULIB_MBSSEP = @GNULIB_MBSSEP@ +GNULIB_MBSSPN = @GNULIB_MBSSPN@ +GNULIB_MBSSTR = @GNULIB_MBSSTR@ +GNULIB_MBSTOK_R = @GNULIB_MBSTOK_R@ +GNULIB_MEMCHR = @GNULIB_MEMCHR@ +GNULIB_MEMMEM = @GNULIB_MEMMEM@ +GNULIB_MEMPCPY = @GNULIB_MEMPCPY@ +GNULIB_MEMRCHR = @GNULIB_MEMRCHR@ +GNULIB_MKDIRAT = @GNULIB_MKDIRAT@ +GNULIB_MKDTEMP = @GNULIB_MKDTEMP@ +GNULIB_MKFIFO = @GNULIB_MKFIFO@ +GNULIB_MKFIFOAT = @GNULIB_MKFIFOAT@ +GNULIB_MKNOD = @GNULIB_MKNOD@ +GNULIB_MKNODAT = @GNULIB_MKNODAT@ +GNULIB_MKOSTEMP = @GNULIB_MKOSTEMP@ +GNULIB_MKOSTEMPS = @GNULIB_MKOSTEMPS@ +GNULIB_MKSTEMP = @GNULIB_MKSTEMP@ +GNULIB_MKSTEMPS = @GNULIB_MKSTEMPS@ +GNULIB_MKTIME = @GNULIB_MKTIME@ +GNULIB_NANOSLEEP = @GNULIB_NANOSLEEP@ +GNULIB_OBSTACK_PRINTF = @GNULIB_OBSTACK_PRINTF@ +GNULIB_OBSTACK_PRINTF_POSIX = @GNULIB_OBSTACK_PRINTF_POSIX@ +GNULIB_PERROR = @GNULIB_PERROR@ +GNULIB_PIPE2 = @GNULIB_PIPE2@ +GNULIB_POPEN = @GNULIB_POPEN@ +GNULIB_PREAD = @GNULIB_PREAD@ +GNULIB_PRINTF = @GNULIB_PRINTF@ +GNULIB_PRINTF_POSIX = @GNULIB_PRINTF_POSIX@ +GNULIB_PTSNAME = @GNULIB_PTSNAME@ +GNULIB_PUTC = @GNULIB_PUTC@ +GNULIB_PUTCHAR = @GNULIB_PUTCHAR@ +GNULIB_PUTENV = @GNULIB_PUTENV@ +GNULIB_PUTS = @GNULIB_PUTS@ +GNULIB_PWRITE = @GNULIB_PWRITE@ +GNULIB_RANDOM_R = @GNULIB_RANDOM_R@ +GNULIB_RAWMEMCHR = @GNULIB_RAWMEMCHR@ +GNULIB_READLINK = @GNULIB_READLINK@ +GNULIB_READLINKAT = @GNULIB_READLINKAT@ +GNULIB_REALLOC_POSIX = @GNULIB_REALLOC_POSIX@ +GNULIB_REALPATH = @GNULIB_REALPATH@ +GNULIB_RECV = @GNULIB_RECV@ +GNULIB_RECVFROM = @GNULIB_RECVFROM@ +GNULIB_REMOVE = @GNULIB_REMOVE@ +GNULIB_RENAME = @GNULIB_RENAME@ +GNULIB_RENAMEAT = @GNULIB_RENAMEAT@ +GNULIB_RMDIR = @GNULIB_RMDIR@ +GNULIB_RPMATCH = @GNULIB_RPMATCH@ +GNULIB_SELECT = @GNULIB_SELECT@ +GNULIB_SEND = @GNULIB_SEND@ +GNULIB_SENDTO = @GNULIB_SENDTO@ +GNULIB_SETENV = @GNULIB_SETENV@ +GNULIB_SETSOCKOPT = @GNULIB_SETSOCKOPT@ +GNULIB_SHUTDOWN = @GNULIB_SHUTDOWN@ +GNULIB_SLEEP = @GNULIB_SLEEP@ +GNULIB_SNPRINTF = @GNULIB_SNPRINTF@ +GNULIB_SOCKET = @GNULIB_SOCKET@ +GNULIB_SPRINTF_POSIX = @GNULIB_SPRINTF_POSIX@ +GNULIB_STAT = @GNULIB_STAT@ +GNULIB_STDIO_H_SIGPIPE = @GNULIB_STDIO_H_SIGPIPE@ +GNULIB_STPCPY = @GNULIB_STPCPY@ +GNULIB_STPNCPY = @GNULIB_STPNCPY@ +GNULIB_STRCASESTR = @GNULIB_STRCASESTR@ +GNULIB_STRCHRNUL = @GNULIB_STRCHRNUL@ +GNULIB_STRDUP = @GNULIB_STRDUP@ +GNULIB_STRERROR = @GNULIB_STRERROR@ +GNULIB_STRNCAT = @GNULIB_STRNCAT@ +GNULIB_STRNDUP = @GNULIB_STRNDUP@ +GNULIB_STRNLEN = @GNULIB_STRNLEN@ +GNULIB_STRPBRK = @GNULIB_STRPBRK@ +GNULIB_STRPTIME = @GNULIB_STRPTIME@ +GNULIB_STRSEP = @GNULIB_STRSEP@ +GNULIB_STRSIGNAL = @GNULIB_STRSIGNAL@ +GNULIB_STRSTR = @GNULIB_STRSTR@ +GNULIB_STRTOD = @GNULIB_STRTOD@ +GNULIB_STRTOK_R = @GNULIB_STRTOK_R@ +GNULIB_STRTOLL = @GNULIB_STRTOLL@ +GNULIB_STRTOULL = @GNULIB_STRTOULL@ +GNULIB_STRVERSCMP = @GNULIB_STRVERSCMP@ +GNULIB_SYMLINK = @GNULIB_SYMLINK@ +GNULIB_SYMLINKAT = @GNULIB_SYMLINKAT@ +GNULIB_TIMEGM = @GNULIB_TIMEGM@ +GNULIB_TIME_R = @GNULIB_TIME_R@ +GNULIB_TMPFILE = @GNULIB_TMPFILE@ +GNULIB_TTYNAME_R = @GNULIB_TTYNAME_R@ +GNULIB_UNISTD_H_GETOPT = @GNULIB_UNISTD_H_GETOPT@ +GNULIB_UNISTD_H_SIGPIPE = @GNULIB_UNISTD_H_SIGPIPE@ +GNULIB_UNLINK = @GNULIB_UNLINK@ +GNULIB_UNLINKAT = @GNULIB_UNLINKAT@ +GNULIB_UNLOCKPT = @GNULIB_UNLOCKPT@ +GNULIB_UNSETENV = @GNULIB_UNSETENV@ +GNULIB_USLEEP = @GNULIB_USLEEP@ +GNULIB_UTIMENSAT = @GNULIB_UTIMENSAT@ +GNULIB_VASPRINTF = @GNULIB_VASPRINTF@ +GNULIB_VDPRINTF = @GNULIB_VDPRINTF@ +GNULIB_VFPRINTF = @GNULIB_VFPRINTF@ +GNULIB_VFPRINTF_POSIX = @GNULIB_VFPRINTF_POSIX@ +GNULIB_VPRINTF = @GNULIB_VPRINTF@ +GNULIB_VPRINTF_POSIX = @GNULIB_VPRINTF_POSIX@ +GNULIB_VSNPRINTF = @GNULIB_VSNPRINTF@ +GNULIB_VSPRINTF_POSIX = @GNULIB_VSPRINTF_POSIX@ +GNULIB_WCRTOMB = @GNULIB_WCRTOMB@ +GNULIB_WCSNRTOMBS = @GNULIB_WCSNRTOMBS@ +GNULIB_WCSRTOMBS = @GNULIB_WCSRTOMBS@ +GNULIB_WCTOB = @GNULIB_WCTOB@ +GNULIB_WCWIDTH = @GNULIB_WCWIDTH@ +GNULIB_WRITE = @GNULIB_WRITE@ +GREP = @GREP@ +GTKDOC_CHECK = @GTKDOC_CHECK@ +GTKDOC_MKPDF = @GTKDOC_MKPDF@ +GTKDOC_REBASE = @GTKDOC_REBASE@ +GUILE = @GUILE@ +GUILE_CFLAGS = @GUILE_CFLAGS@ +GUILE_CONFIG = @GUILE_CONFIG@ +GUILE_LDFLAGS = @GUILE_LDFLAGS@ +GUILE_SITE = @GUILE_SITE@ +GUILE_TOOLS = @GUILE_TOOLS@ +HAVE_ACCEPT4 = @HAVE_ACCEPT4@ +HAVE_ARPA_INET_H = @HAVE_ARPA_INET_H@ +HAVE_ATOLL = @HAVE_ATOLL@ +HAVE_BTOWC = @HAVE_BTOWC@ +HAVE_CALLOC_POSIX = @HAVE_CALLOC_POSIX@ +HAVE_CANONICALIZE_FILE_NAME = @HAVE_CANONICALIZE_FILE_NAME@ +HAVE_CHOWN = @HAVE_CHOWN@ +HAVE_DECL_ENVIRON = @HAVE_DECL_ENVIRON@ +HAVE_DECL_FPURGE = @HAVE_DECL_FPURGE@ +HAVE_DECL_FREEADDRINFO = @HAVE_DECL_FREEADDRINFO@ +HAVE_DECL_GAI_STRERROR = @HAVE_DECL_GAI_STRERROR@ +HAVE_DECL_GETADDRINFO = @HAVE_DECL_GETADDRINFO@ +HAVE_DECL_GETDELIM = @HAVE_DECL_GETDELIM@ +HAVE_DECL_GETLINE = @HAVE_DECL_GETLINE@ +HAVE_DECL_GETLOADAVG = @HAVE_DECL_GETLOADAVG@ +HAVE_DECL_GETLOGIN_R = @HAVE_DECL_GETLOGIN_R@ +HAVE_DECL_GETNAMEINFO = @HAVE_DECL_GETNAMEINFO@ +HAVE_DECL_GETPAGESIZE = @HAVE_DECL_GETPAGESIZE@ +HAVE_DECL_GETUSERSHELL = @HAVE_DECL_GETUSERSHELL@ +HAVE_DECL_INET_NTOP = @HAVE_DECL_INET_NTOP@ +HAVE_DECL_INET_PTON = @HAVE_DECL_INET_PTON@ +HAVE_DECL_MEMMEM = @HAVE_DECL_MEMMEM@ +HAVE_DECL_MEMRCHR = @HAVE_DECL_MEMRCHR@ +HAVE_DECL_OBSTACK_PRINTF = @HAVE_DECL_OBSTACK_PRINTF@ +HAVE_DECL_SNPRINTF = @HAVE_DECL_SNPRINTF@ +HAVE_DECL_STRDUP = @HAVE_DECL_STRDUP@ +HAVE_DECL_STRNDUP = @HAVE_DECL_STRNDUP@ +HAVE_DECL_STRNLEN = @HAVE_DECL_STRNLEN@ +HAVE_DECL_STRSIGNAL = @HAVE_DECL_STRSIGNAL@ +HAVE_DECL_STRTOK_R = @HAVE_DECL_STRTOK_R@ +HAVE_DECL_VSNPRINTF = @HAVE_DECL_VSNPRINTF@ +HAVE_DECL_WCTOB = @HAVE_DECL_WCTOB@ +HAVE_DECL_WCWIDTH = @HAVE_DECL_WCWIDTH@ +HAVE_DPRINTF = @HAVE_DPRINTF@ +HAVE_DUP2 = @HAVE_DUP2@ +HAVE_DUP3 = @HAVE_DUP3@ +HAVE_EUIDACCESS = @HAVE_EUIDACCESS@ +HAVE_FACCESSAT = @HAVE_FACCESSAT@ +HAVE_FCHDIR = @HAVE_FCHDIR@ +HAVE_FCHMODAT = @HAVE_FCHMODAT@ +HAVE_FCHOWNAT = @HAVE_FCHOWNAT@ +HAVE_FSEEKO = @HAVE_FSEEKO@ +HAVE_FSTATAT = @HAVE_FSTATAT@ +HAVE_FSYNC = @HAVE_FSYNC@ +HAVE_FTELLO = @HAVE_FTELLO@ +HAVE_FTRUNCATE = @HAVE_FTRUNCATE@ +HAVE_FUTIMENS = @HAVE_FUTIMENS@ +HAVE_GETDOMAINNAME = @HAVE_GETDOMAINNAME@ +HAVE_GETDTABLESIZE = @HAVE_GETDTABLESIZE@ +HAVE_GETGROUPS = @HAVE_GETGROUPS@ +HAVE_GETHOSTNAME = @HAVE_GETHOSTNAME@ +HAVE_GETLOGIN = @HAVE_GETLOGIN@ +HAVE_GETPAGESIZE = @HAVE_GETPAGESIZE@ +HAVE_GETSUBOPT = @HAVE_GETSUBOPT@ +HAVE_GETTIMEOFDAY = @HAVE_GETTIMEOFDAY@ +HAVE_GRANTPT = @HAVE_GRANTPT@ +HAVE_INTTYPES_H = @HAVE_INTTYPES_H@ +HAVE_LCHMOD = @HAVE_LCHMOD@ +HAVE_LCHOWN = @HAVE_LCHOWN@ +HAVE_LIBGCRYPT = @HAVE_LIBGCRYPT@ +HAVE_LIBTASN1 = @HAVE_LIBTASN1@ +HAVE_LINK = @HAVE_LINK@ +HAVE_LINKAT = @HAVE_LINKAT@ +HAVE_LOCALTIME_R = @HAVE_LOCALTIME_R@ +HAVE_LONG_LONG_INT = @HAVE_LONG_LONG_INT@ +HAVE_LSTAT = @HAVE_LSTAT@ +HAVE_MALLOC_POSIX = @HAVE_MALLOC_POSIX@ +HAVE_MBRLEN = @HAVE_MBRLEN@ +HAVE_MBRTOWC = @HAVE_MBRTOWC@ +HAVE_MBSINIT = @HAVE_MBSINIT@ +HAVE_MBSLEN = @HAVE_MBSLEN@ +HAVE_MBSNRTOWCS = @HAVE_MBSNRTOWCS@ +HAVE_MBSRTOWCS = @HAVE_MBSRTOWCS@ +HAVE_MEMCHR = @HAVE_MEMCHR@ +HAVE_MEMPCPY = @HAVE_MEMPCPY@ +HAVE_MKDIRAT = @HAVE_MKDIRAT@ +HAVE_MKDTEMP = @HAVE_MKDTEMP@ +HAVE_MKFIFO = @HAVE_MKFIFO@ +HAVE_MKFIFOAT = @HAVE_MKFIFOAT@ +HAVE_MKNOD = @HAVE_MKNOD@ +HAVE_MKNODAT = @HAVE_MKNODAT@ +HAVE_MKOSTEMP = @HAVE_MKOSTEMP@ +HAVE_MKOSTEMPS = @HAVE_MKOSTEMPS@ +HAVE_MKSTEMP = @HAVE_MKSTEMP@ +HAVE_MKSTEMPS = @HAVE_MKSTEMPS@ +HAVE_NANOSLEEP = @HAVE_NANOSLEEP@ +HAVE_NETDB_H = @HAVE_NETDB_H@ +HAVE_NETINET_IN_H = @HAVE_NETINET_IN_H@ +HAVE_OS_H = @HAVE_OS_H@ +HAVE_PIPE2 = @HAVE_PIPE2@ +HAVE_PREAD = @HAVE_PREAD@ +HAVE_PTSNAME = @HAVE_PTSNAME@ +HAVE_PWRITE = @HAVE_PWRITE@ +HAVE_RANDOM_H = @HAVE_RANDOM_H@ +HAVE_RANDOM_R = @HAVE_RANDOM_R@ +HAVE_RAWMEMCHR = @HAVE_RAWMEMCHR@ +HAVE_READLINK = @HAVE_READLINK@ +HAVE_READLINKAT = @HAVE_READLINKAT@ +HAVE_REALLOC_POSIX = @HAVE_REALLOC_POSIX@ +HAVE_REALPATH = @HAVE_REALPATH@ +HAVE_RENAMEAT = @HAVE_RENAMEAT@ +HAVE_RPMATCH = @HAVE_RPMATCH@ +HAVE_SA_FAMILY_T = @HAVE_SA_FAMILY_T@ +HAVE_SETENV = @HAVE_SETENV@ +HAVE_SIGNED_SIG_ATOMIC_T = @HAVE_SIGNED_SIG_ATOMIC_T@ +HAVE_SIGNED_WCHAR_T = @HAVE_SIGNED_WCHAR_T@ +HAVE_SIGNED_WINT_T = @HAVE_SIGNED_WINT_T@ +HAVE_SLEEP = @HAVE_SLEEP@ +HAVE_STDINT_H = @HAVE_STDINT_H@ +HAVE_STPCPY = @HAVE_STPCPY@ +HAVE_STPNCPY = @HAVE_STPNCPY@ +HAVE_STRCASESTR = @HAVE_STRCASESTR@ +HAVE_STRCHRNUL = @HAVE_STRCHRNUL@ +HAVE_STRPBRK = @HAVE_STRPBRK@ +HAVE_STRPTIME = @HAVE_STRPTIME@ +HAVE_STRSEP = @HAVE_STRSEP@ +HAVE_STRTOD = @HAVE_STRTOD@ +HAVE_STRTOLL = @HAVE_STRTOLL@ +HAVE_STRTOULL = @HAVE_STRTOULL@ +HAVE_STRUCT_ADDRINFO = @HAVE_STRUCT_ADDRINFO@ +HAVE_STRUCT_RANDOM_DATA = @HAVE_STRUCT_RANDOM_DATA@ +HAVE_STRUCT_SOCKADDR_STORAGE = @HAVE_STRUCT_SOCKADDR_STORAGE@ +HAVE_STRUCT_TIMEVAL = @HAVE_STRUCT_TIMEVAL@ +HAVE_STRVERSCMP = @HAVE_STRVERSCMP@ +HAVE_SYMLINK = @HAVE_SYMLINK@ +HAVE_SYMLINKAT = @HAVE_SYMLINKAT@ +HAVE_SYS_BITYPES_H = @HAVE_SYS_BITYPES_H@ +HAVE_SYS_INTTYPES_H = @HAVE_SYS_INTTYPES_H@ +HAVE_SYS_IOCTL_H = @HAVE_SYS_IOCTL_H@ +HAVE_SYS_LOADAVG_H = @HAVE_SYS_LOADAVG_H@ +HAVE_SYS_PARAM_H = @HAVE_SYS_PARAM_H@ +HAVE_SYS_SELECT_H = @HAVE_SYS_SELECT_H@ +HAVE_SYS_SOCKET_H = @HAVE_SYS_SOCKET_H@ +HAVE_SYS_TIME_H = @HAVE_SYS_TIME_H@ +HAVE_SYS_TYPES_H = @HAVE_SYS_TYPES_H@ +HAVE_TIMEGM = @HAVE_TIMEGM@ +HAVE_TTYNAME_R = @HAVE_TTYNAME_R@ +HAVE_UNISTD_H = @HAVE_UNISTD_H@ +HAVE_UNLINKAT = @HAVE_UNLINKAT@ +HAVE_UNLOCKPT = @HAVE_UNLOCKPT@ +HAVE_UNSETENV = @HAVE_UNSETENV@ +HAVE_UNSIGNED_LONG_LONG_INT = @HAVE_UNSIGNED_LONG_LONG_INT@ +HAVE_USLEEP = @HAVE_USLEEP@ +HAVE_UTIMENSAT = @HAVE_UTIMENSAT@ +HAVE_VASPRINTF = @HAVE_VASPRINTF@ +HAVE_VDPRINTF = @HAVE_VDPRINTF@ +HAVE_WCHAR_H = @HAVE_WCHAR_H@ +HAVE_WCHAR_T = @HAVE_WCHAR_T@ +HAVE_WCRTOMB = @HAVE_WCRTOMB@ +HAVE_WCSNRTOMBS = @HAVE_WCSNRTOMBS@ +HAVE_WCSRTOMBS = @HAVE_WCSRTOMBS@ +HAVE_WINSOCK2_H = @HAVE_WINSOCK2_H@ +HAVE_WINT_T = @HAVE_WINT_T@ +HAVE_WS2TCPIP_H = @HAVE_WS2TCPIP_H@ +HAVE__BOOL = @HAVE__BOOL@ +HOSTENT_LIB = @HOSTENT_LIB@ +HTML_DIR = @HTML_DIR@ +INCLUDE_NEXT = @INCLUDE_NEXT@ +INCLUDE_NEXT_AS_FIRST_DIRECTIVE = @INCLUDE_NEXT_AS_FIRST_DIRECTIVE@ +INET_NTOP_LIB = @INET_NTOP_LIB@ +INET_PTON_LIB = @INET_PTON_LIB@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LD = @LD@ +LDFLAGS = @LDFLAGS@ +LIBGCRYPT = @LIBGCRYPT@ +LIBGCRYPT_PREFIX = @LIBGCRYPT_PREFIX@ +LIBINTL = @LIBINTL@ +LIBOBJS = @LIBOBJS@ +LIBREADLINE = @LIBREADLINE@ +LIBS = @LIBS@ +LIBSOCKET = @LIBSOCKET@ +LIBTASN1 = @LIBTASN1@ +LIBTASN1_PREFIX = @LIBTASN1_PREFIX@ +LIBTESTS_LIBDEPS = @LIBTESTS_LIBDEPS@ +LIBTOOL = @LIBTOOL@ +LIB_CLOCK_GETTIME = @LIB_CLOCK_GETTIME@ +LIPO = @LIPO@ +LN_S = @LN_S@ +LTALLOCA = @LTALLOCA@ +LTLIBGCRYPT = @LTLIBGCRYPT@ +LTLIBINTL = @LTLIBINTL@ +LTLIBOBJS = @LTLIBOBJS@ +LTLIBREADLINE = @LTLIBREADLINE@ +LTLIBTASN1 = @LTLIBTASN1@ +LT_AGE = @LT_AGE@ +LT_CURRENT = @LT_CURRENT@ +LT_REVISION = @LT_REVISION@ +LZO_LIBS = @LZO_LIBS@ +MAKEINFO = @MAKEINFO@ +MKDIR_P = @MKDIR_P@ +NETINET_IN_H = @NETINET_IN_H@ +NEXT_ARPA_INET_H = @NEXT_ARPA_INET_H@ +NEXT_AS_FIRST_DIRECTIVE_ARPA_INET_H = @NEXT_AS_FIRST_DIRECTIVE_ARPA_INET_H@ +NEXT_AS_FIRST_DIRECTIVE_ERRNO_H = @NEXT_AS_FIRST_DIRECTIVE_ERRNO_H@ +NEXT_AS_FIRST_DIRECTIVE_FLOAT_H = @NEXT_AS_FIRST_DIRECTIVE_FLOAT_H@ +NEXT_AS_FIRST_DIRECTIVE_NETDB_H = @NEXT_AS_FIRST_DIRECTIVE_NETDB_H@ +NEXT_AS_FIRST_DIRECTIVE_NETINET_IN_H = @NEXT_AS_FIRST_DIRECTIVE_NETINET_IN_H@ +NEXT_AS_FIRST_DIRECTIVE_STDARG_H = @NEXT_AS_FIRST_DIRECTIVE_STDARG_H@ +NEXT_AS_FIRST_DIRECTIVE_STDDEF_H = @NEXT_AS_FIRST_DIRECTIVE_STDDEF_H@ +NEXT_AS_FIRST_DIRECTIVE_STDINT_H = @NEXT_AS_FIRST_DIRECTIVE_STDINT_H@ +NEXT_AS_FIRST_DIRECTIVE_STDIO_H = @NEXT_AS_FIRST_DIRECTIVE_STDIO_H@ +NEXT_AS_FIRST_DIRECTIVE_STDLIB_H = @NEXT_AS_FIRST_DIRECTIVE_STDLIB_H@ +NEXT_AS_FIRST_DIRECTIVE_STRING_H = @NEXT_AS_FIRST_DIRECTIVE_STRING_H@ +NEXT_AS_FIRST_DIRECTIVE_SYS_IOCTL_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_IOCTL_H@ +NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H@ +NEXT_AS_FIRST_DIRECTIVE_SYS_SOCKET_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_SOCKET_H@ +NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H@ +NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H@ +NEXT_AS_FIRST_DIRECTIVE_TIME_H = @NEXT_AS_FIRST_DIRECTIVE_TIME_H@ +NEXT_AS_FIRST_DIRECTIVE_UNISTD_H = @NEXT_AS_FIRST_DIRECTIVE_UNISTD_H@ +NEXT_AS_FIRST_DIRECTIVE_WCHAR_H = @NEXT_AS_FIRST_DIRECTIVE_WCHAR_H@ +NEXT_ERRNO_H = @NEXT_ERRNO_H@ +NEXT_FLOAT_H = @NEXT_FLOAT_H@ +NEXT_NETDB_H = @NEXT_NETDB_H@ +NEXT_NETINET_IN_H = @NEXT_NETINET_IN_H@ +NEXT_STDARG_H = @NEXT_STDARG_H@ +NEXT_STDDEF_H = @NEXT_STDDEF_H@ +NEXT_STDINT_H = @NEXT_STDINT_H@ +NEXT_STDIO_H = @NEXT_STDIO_H@ +NEXT_STDLIB_H = @NEXT_STDLIB_H@ +NEXT_STRING_H = @NEXT_STRING_H@ +NEXT_SYS_IOCTL_H = @NEXT_SYS_IOCTL_H@ +NEXT_SYS_SELECT_H = @NEXT_SYS_SELECT_H@ +NEXT_SYS_SOCKET_H = @NEXT_SYS_SOCKET_H@ +NEXT_SYS_STAT_H = @NEXT_SYS_STAT_H@ +NEXT_SYS_TIME_H = @NEXT_SYS_TIME_H@ +NEXT_TIME_H = @NEXT_TIME_H@ +NEXT_UNISTD_H = @NEXT_UNISTD_H@ +NEXT_WCHAR_H = @NEXT_WCHAR_H@ +NM = @NM@ +NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ +OBJEXT = @OBJEXT@ +OTOOL = @OTOOL@ +OTOOL64 = @OTOOL64@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_URL = @PACKAGE_URL@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PKG_CONFIG = @PKG_CONFIG@ +PMCCABE = @PMCCABE@ +PRAGMA_SYSTEM_HEADER = @PRAGMA_SYSTEM_HEADER@ +PTHREAD_H_DEFINES_STRUCT_TIMESPEC = @PTHREAD_H_DEFINES_STRUCT_TIMESPEC@ +PTRDIFF_T_SUFFIX = @PTRDIFF_T_SUFFIX@ +RANLIB = @RANLIB@ +REPLACE_BTOWC = @REPLACE_BTOWC@ +REPLACE_CANONICALIZE_FILE_NAME = @REPLACE_CANONICALIZE_FILE_NAME@ +REPLACE_CHOWN = @REPLACE_CHOWN@ +REPLACE_CLOSE = @REPLACE_CLOSE@ +REPLACE_DPRINTF = @REPLACE_DPRINTF@ +REPLACE_DUP = @REPLACE_DUP@ +REPLACE_DUP2 = @REPLACE_DUP2@ +REPLACE_FCHOWNAT = @REPLACE_FCHOWNAT@ +REPLACE_FCLOSE = @REPLACE_FCLOSE@ +REPLACE_FFLUSH = @REPLACE_FFLUSH@ +REPLACE_FOPEN = @REPLACE_FOPEN@ +REPLACE_FPRINTF = @REPLACE_FPRINTF@ +REPLACE_FPURGE = @REPLACE_FPURGE@ +REPLACE_FREOPEN = @REPLACE_FREOPEN@ +REPLACE_FSEEK = @REPLACE_FSEEK@ +REPLACE_FSEEKO = @REPLACE_FSEEKO@ +REPLACE_FSTAT = @REPLACE_FSTAT@ +REPLACE_FSTATAT = @REPLACE_FSTATAT@ +REPLACE_FTELL = @REPLACE_FTELL@ +REPLACE_FTELLO = @REPLACE_FTELLO@ +REPLACE_FUTIMENS = @REPLACE_FUTIMENS@ +REPLACE_GETCWD = @REPLACE_GETCWD@ +REPLACE_GETDELIM = @REPLACE_GETDELIM@ +REPLACE_GETGROUPS = @REPLACE_GETGROUPS@ +REPLACE_GETLINE = @REPLACE_GETLINE@ +REPLACE_GETPAGESIZE = @REPLACE_GETPAGESIZE@ +REPLACE_GETTIMEOFDAY = @REPLACE_GETTIMEOFDAY@ +REPLACE_IOCTL = @REPLACE_IOCTL@ +REPLACE_LCHOWN = @REPLACE_LCHOWN@ +REPLACE_LINK = @REPLACE_LINK@ +REPLACE_LINKAT = @REPLACE_LINKAT@ +REPLACE_LOCALTIME_R = @REPLACE_LOCALTIME_R@ +REPLACE_LSEEK = @REPLACE_LSEEK@ +REPLACE_LSTAT = @REPLACE_LSTAT@ +REPLACE_MBRLEN = @REPLACE_MBRLEN@ +REPLACE_MBRTOWC = @REPLACE_MBRTOWC@ +REPLACE_MBSINIT = @REPLACE_MBSINIT@ +REPLACE_MBSNRTOWCS = @REPLACE_MBSNRTOWCS@ +REPLACE_MBSRTOWCS = @REPLACE_MBSRTOWCS@ +REPLACE_MBSTATE_T = @REPLACE_MBSTATE_T@ +REPLACE_MEMCHR = @REPLACE_MEMCHR@ +REPLACE_MEMMEM = @REPLACE_MEMMEM@ +REPLACE_MKDIR = @REPLACE_MKDIR@ +REPLACE_MKFIFO = @REPLACE_MKFIFO@ +REPLACE_MKNOD = @REPLACE_MKNOD@ +REPLACE_MKSTEMP = @REPLACE_MKSTEMP@ +REPLACE_MKTIME = @REPLACE_MKTIME@ +REPLACE_NANOSLEEP = @REPLACE_NANOSLEEP@ +REPLACE_NULL = @REPLACE_NULL@ +REPLACE_OBSTACK_PRINTF = @REPLACE_OBSTACK_PRINTF@ +REPLACE_PERROR = @REPLACE_PERROR@ +REPLACE_POPEN = @REPLACE_POPEN@ +REPLACE_PREAD = @REPLACE_PREAD@ +REPLACE_PRINTF = @REPLACE_PRINTF@ +REPLACE_PUTENV = @REPLACE_PUTENV@ +REPLACE_PWRITE = @REPLACE_PWRITE@ +REPLACE_READLINK = @REPLACE_READLINK@ +REPLACE_REALPATH = @REPLACE_REALPATH@ +REPLACE_REMOVE = @REPLACE_REMOVE@ +REPLACE_RENAME = @REPLACE_RENAME@ +REPLACE_RENAMEAT = @REPLACE_RENAMEAT@ +REPLACE_RMDIR = @REPLACE_RMDIR@ +REPLACE_SELECT = @REPLACE_SELECT@ +REPLACE_SETENV = @REPLACE_SETENV@ +REPLACE_SLEEP = @REPLACE_SLEEP@ +REPLACE_SNPRINTF = @REPLACE_SNPRINTF@ +REPLACE_SPRINTF = @REPLACE_SPRINTF@ +REPLACE_STAT = @REPLACE_STAT@ +REPLACE_STDIO_WRITE_FUNCS = @REPLACE_STDIO_WRITE_FUNCS@ +REPLACE_STPNCPY = @REPLACE_STPNCPY@ +REPLACE_STRCASESTR = @REPLACE_STRCASESTR@ +REPLACE_STRDUP = @REPLACE_STRDUP@ +REPLACE_STRERROR = @REPLACE_STRERROR@ +REPLACE_STRNCAT = @REPLACE_STRNCAT@ +REPLACE_STRNDUP = @REPLACE_STRNDUP@ +REPLACE_STRNLEN = @REPLACE_STRNLEN@ +REPLACE_STRSIGNAL = @REPLACE_STRSIGNAL@ +REPLACE_STRSTR = @REPLACE_STRSTR@ +REPLACE_STRTOD = @REPLACE_STRTOD@ +REPLACE_STRTOK_R = @REPLACE_STRTOK_R@ +REPLACE_SYMLINK = @REPLACE_SYMLINK@ +REPLACE_TIMEGM = @REPLACE_TIMEGM@ +REPLACE_TMPFILE = @REPLACE_TMPFILE@ +REPLACE_TTYNAME_R = @REPLACE_TTYNAME_R@ +REPLACE_UNLINK = @REPLACE_UNLINK@ +REPLACE_UNLINKAT = @REPLACE_UNLINKAT@ +REPLACE_UNSETENV = @REPLACE_UNSETENV@ +REPLACE_USLEEP = @REPLACE_USLEEP@ +REPLACE_UTIMENSAT = @REPLACE_UTIMENSAT@ +REPLACE_VASPRINTF = @REPLACE_VASPRINTF@ +REPLACE_VDPRINTF = @REPLACE_VDPRINTF@ +REPLACE_VFPRINTF = @REPLACE_VFPRINTF@ +REPLACE_VPRINTF = @REPLACE_VPRINTF@ +REPLACE_VSNPRINTF = @REPLACE_VSNPRINTF@ +REPLACE_VSPRINTF = @REPLACE_VSPRINTF@ +REPLACE_WCRTOMB = @REPLACE_WCRTOMB@ +REPLACE_WCSNRTOMBS = @REPLACE_WCSNRTOMBS@ +REPLACE_WCSRTOMBS = @REPLACE_WCSRTOMBS@ +REPLACE_WCTOB = @REPLACE_WCTOB@ +REPLACE_WCWIDTH = @REPLACE_WCWIDTH@ +REPLACE_WRITE = @REPLACE_WRITE@ +SED = @SED@ +SERVENT_LIB = @SERVENT_LIB@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +SIG_ATOMIC_T_SUFFIX = @SIG_ATOMIC_T_SUFFIX@ +SIZE_T_SUFFIX = @SIZE_T_SUFFIX@ +STDARG_H = @STDARG_H@ +STDBOOL_H = @STDBOOL_H@ +STDDEF_H = @STDDEF_H@ +STDINT_H = @STDINT_H@ +STRIP = @STRIP@ +SYS_IOCTL_H_HAVE_WINSOCK2_H = @SYS_IOCTL_H_HAVE_WINSOCK2_H@ +SYS_IOCTL_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS = @SYS_IOCTL_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS@ +SYS_TIME_H_DEFINES_STRUCT_TIMESPEC = @SYS_TIME_H_DEFINES_STRUCT_TIMESPEC@ +TIME_H_DEFINES_STRUCT_TIMESPEC = @TIME_H_DEFINES_STRUCT_TIMESPEC@ +UNDEFINE_STRTOK_R = @UNDEFINE_STRTOK_R@ +UNISTD_H_HAVE_WINSOCK2_H = @UNISTD_H_HAVE_WINSOCK2_H@ +UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS = @UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS@ +VALGRIND = @VALGRIND@ +VERSION = @VERSION@ +WARN_CFLAGS = @WARN_CFLAGS@ +WCHAR_T_SUFFIX = @WCHAR_T_SUFFIX@ +WERROR_CFLAGS = @WERROR_CFLAGS@ +WINT_T_SUFFIX = @WINT_T_SUFFIX@ +WSTACK_CFLAGS = @WSTACK_CFLAGS@ +abs_aux_dir = @abs_aux_dir@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_CXX = @ac_ct_CXX@ +ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +datadir = @datadir@ +datarootdir = @datarootdir@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +gl_LIBOBJS = @gl_LIBOBJS@ +gl_LTLIBOBJS = @gl_LTLIBOBJS@ +gltests_LIBOBJS = @gltests_LIBOBJS@ +gltests_LTLIBOBJS = @gltests_LTLIBOBJS@ +gltests_WITNESS = @gltests_WITNESS@ +guile_snarf = @guile_snarf@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +libdir = @libdir@ +libexecdir = @libexecdir@ +localedir = @localedir@ +localstatedir = @localstatedir@ +mandir = @mandir@ +mkdir_p = @mkdir_p@ +oldincludedir = @oldincludedir@ +pdfdir = @pdfdir@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +sbindir = @sbindir@ +sharedstatedir = @sharedstatedir@ +srcdir = @srcdir@ +subdirs = @subdirs@ +sysconfdir = @sysconfdir@ +target_alias = @target_alias@ +top_build_prefix = @top_build_prefix@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS) +AM_CPPFLAGS = \ + -I$(top_srcdir)/lib/includes \ + -I$(top_builddir)/lib/includes + +AM_LDFLAGS = -no-install +LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) +ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7 +TESTS_ENVIRONMENT = $(VALGRIND) +EXTRA_DIST = README params.dh +dist_check_SCRIPTS = testsrn +all: all-am + +.SUFFIXES: + .SUFFIXES: .c .lo .o .obj + $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile'; \ + $(am__cd) $(top_srcdir) && \ + $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile + .PRECIOUS: Makefile + Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(am__aclocal_m4_deps): + +clean-checkPROGRAMS: + @list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \ + echo " rm -f" $$list; \ + rm -f $$list || exit $$?; \ + test -n "$(EXEEXT)" || exit 0; \ + list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ + echo " rm -f" $$list; \ + rm -f $$list + srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) + @rm -f srn0$(EXEEXT) + $(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS) +srn1$(EXEEXT): $(srn1_OBJECTS) $(srn1_DEPENDENCIES) + @rm -f srn1$(EXEEXT) + $(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS) +srn2$(EXEEXT): $(srn2_OBJECTS) $(srn2_DEPENDENCIES) + @rm -f srn2$(EXEEXT) + $(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS) +srn3$(EXEEXT): $(srn3_OBJECTS) $(srn3_DEPENDENCIES) + @rm -f srn3$(EXEEXT) + $(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS) +srn4$(EXEEXT): $(srn4_OBJECTS) $(srn4_DEPENDENCIES) + @rm -f srn4$(EXEEXT) + $(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS) +srn5$(EXEEXT): $(srn5_OBJECTS) $(srn5_DEPENDENCIES) + @rm -f srn5$(EXEEXT) + $(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS) +srn6$(EXEEXT): $(srn6_OBJECTS) $(srn6_DEPENDENCIES) + @rm -f srn6$(EXEEXT) + $(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS) +srn7$(EXEEXT): $(srn7_OBJECTS) $(srn7_DEPENDENCIES) + @rm -f srn7$(EXEEXT) + $(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn0.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn1.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn2.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn3.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn4.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn5.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn6.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn7.Po@am__quote@ + +.c.o: + @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< + @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po + @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ + @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ + @am__fastdepCC_FALSE@ $(COMPILE) -c $< + +.c.obj: + @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` + @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po + @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ + @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ + @am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: + @am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< + @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo + @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ + @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ + @am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + mkid -fID $$unique + tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + set x; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + shift; \ + if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + if test $$# -gt 0; then \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + "$$@" $$unique; \ + else \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$unique; \ + fi; \ + fi + ctags: CTAGS + CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + test -z "$(CTAGS_ARGS)$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && $(am__cd) $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) "$$here" + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +check-TESTS: $(TESTS) + @failed=0; all=0; xfail=0; xpass=0; skip=0; \ + srcdir=$(srcdir); export srcdir; \ + list=' $(TESTS) '; \ + $(am__tty_colors); \ + if test -n "$$list"; then \ + for tst in $$list; do \ + if test -f ./$$tst; then dir=./; \ + elif test -f $$tst; then dir=; \ + else dir="$(srcdir)/"; fi; \ + if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *[\ \ ]$$tst[\ \ ]*) \ + xpass=`expr $$xpass + 1`; \ + failed=`expr $$failed + 1`; \ + col=$$red; res=XPASS; \ + ;; \ + *) \ + col=$$grn; res=PASS; \ + ;; \ + esac; \ + elif test $$? -ne 77; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *[\ \ ]$$tst[\ \ ]*) \ + xfail=`expr $$xfail + 1`; \ + col=$$lgn; res=XFAIL; \ + ;; \ + *) \ + failed=`expr $$failed + 1`; \ + col=$$red; res=FAIL; \ + ;; \ + esac; \ + else \ + skip=`expr $$skip + 1`; \ + col=$$blu; res=SKIP; \ + fi; \ + echo "$${col}$$res$${std}: $$tst"; \ + done; \ + if test "$$all" -eq 1; then \ + tests="test"; \ + All=""; \ + else \ + tests="tests"; \ + All="All "; \ + fi; \ + if test "$$failed" -eq 0; then \ + if test "$$xfail" -eq 0; then \ + banner="$$All$$all $$tests passed"; \ + else \ + if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \ + banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \ + fi; \ + else \ + if test "$$xpass" -eq 0; then \ + banner="$$failed of $$all $$tests failed"; \ + else \ + if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \ + banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \ + fi; \ + fi; \ + dashes="$$banner"; \ + skipped=""; \ + if test "$$skip" -ne 0; then \ + if test "$$skip" -eq 1; then \ + skipped="($$skip test was not run)"; \ + else \ + skipped="($$skip tests were not run)"; \ + fi; \ + test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$skipped"; \ + fi; \ + report=""; \ + if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \ + report="Please report to $(PACKAGE_BUGREPORT)"; \ + test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$report"; \ + fi; \ + dashes=`echo "$$dashes" | sed s/./=/g`; \ + if test "$$failed" -eq 0; then \ + echo "$$grn$$dashes"; \ + else \ + echo "$$red$$dashes"; \ + fi; \ + echo "$$banner"; \ + test -z "$$skipped" || echo "$$skipped"; \ + test -z "$$report" || echo "$$report"; \ + echo "$$dashes$$std"; \ + test "$$failed" -eq 0; \ + else :; fi + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d "$(distdir)/$$file"; then \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ + else \ + test -f "$(distdir)/$$file" \ + || cp -p $$d/$$file "$(distdir)/$$file" \ + || exit 1; \ + fi; \ + done + check-am: all-am + $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) \ + $(dist_check_SCRIPTS) + $(MAKE) $(AM_MAKEFLAGS) check-TESTS + check: check-am + all-am: Makefile +installdirs: + install: install-am + install-exec: install-exec-am + install-data: install-data-am + uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am + install-strip: + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + `test -z '$(STRIP)' || \ + echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." + clean: clean-am + +clean-am: clean-checkPROGRAMS clean-generic clean-libtool \ + mostlyclean-am + +distclean: distclean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile + distclean-am: clean-am distclean-compile distclean-generic \ + distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +html-am: + +info: info-am + +info-am: + +install-data-am: + +install-dvi: install-dvi-am + +install-dvi-am: + +install-exec-am: + +install-html: install-html-am + +install-html-am: + +install-info: install-info-am + +install-info-am: + +install-man: + +install-pdf: install-pdf-am + +install-pdf-am: + +install-ps: install-ps-am + +install-ps-am: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile + maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: + +.MAKE: check-am install-am install-strip + +.PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \ + clean-checkPROGRAMS clean-generic clean-libtool ctags \ + distclean distclean-compile distclean-generic \ + distclean-libtool distclean-tags distdir dvi dvi-am html \ + html-am info info-am install install-am install-data \ + install-data-am install-dvi install-dvi-am install-exec \ + install-exec-am install-html install-html-am install-info \ + install-info-am install-man install-pdf install-pdf-am \ + install-ps install-ps-am install-strip installcheck \ + installcheck-am installdirs maintainer-clean \ + maintainer-clean-generic mostlyclean mostlyclean-compile \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + tags uninstall uninstall-am + +#TESTS = testsrn + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# # Otherwise a system limit (for SysV at least) may be exceeded. +# .NOEXPORT: Index: gnutls-2.4.1/tests/safe-renegotiation/README =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/README @@ -0,0 +1,93 @@ +Testing safe renegotiation is relatively complex, here is a summary of +what we test and what how we believe it should work. + + Client setting + Server setting + Initial handshake outcome + Rehandshake outcome +srn0.c + + This tests that the safe renegotiation extension is negotiated + properly by default on initial connections and on rehandshaked + connections. Consequently, it also verifies that rehandshaked + connections work with the extension enabled. + + NORMAL + NORMAL + OK + OK + +srn1.c + + This tests that clients without support for safe renegotiation is + able to handshake against servers with support, but not able to + rehandshake (server will refuse rehandshake). + + NORMAL:%DISABLE_SAFE_RENEGOTIATION + NORMAL + OK + Server refuses + +srn2.c + + This tests that clients with support for safe renegotiation is able + to handshake against servers without support, but not able to + rehandshake (client will refuse rehandshake). + + NORMAL + NORMAL:%DISABLE_SAFE_RENEGOTIATION + OK + Client refuses + +srn3.c + + This tests that a %SAFE_RENEGOTIATION client will reject handshakes + against servers that do not support the extension (server uses + %DISABLE_SAFE_RENEGOTIATION). + + NORMAL:%SAFE_RENEGOTIATION + NORMAL:%DISABLE_SAFE_RENEGOTIATION + Client refuses + N/A + +srn4.c + + This tests that a %SAFE_RENEGOTIATION server will reject handshakes + against clients that do not support the extension. + + NORMAL:%DISABLE_SAFE_RENEGOTIATION + NORMAL:%SAFE_RENEGOTIATION + Server refuses + N/A + +srn5.c + + This tests that a client with a permissive policy + (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a + server with no support for the extension. + + NORMAL:%DISABLE_SAFE_RENEGOTIATION + NORMAL:%UNSAFE_RENEGOTIATION + OK + OK + +srn6.c + + This tests that a server with a permissive policy + (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a + client with no support for the extension. + + NORMAL:%UNSAFE_RENEGOTIATION + NORMAL:%DISABLE_SAFE_RENEGOTIATION + OK + OK + +srn7.c + + This tests that clients and servers in %SAFE_RENEGOTIATION mode are + able to handshake and rehandshake. + + NORMAL:%SAFE_RENEGOTIATION + NORMAL:%SAFE_RENEGOTIATION + OK + OK Index: gnutls-2.4.1/tests/safe-renegotiation/params.dh =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/params.dh @@ -0,0 +1,35 @@ + +Generator: 05 + +Prime: c9:e9:2d:fc:94:15:1a:10:4f:3c:b5:16 + 7e:34:10:7d:eb:3d:d5:7d:61:ff:b0:ce + da:7f:6e:0c:ea:db:b4:87:f6:c6:34:a8 + 3c:f8:84:52:14:59:ab:17:5c:d0:f0:86 + c4:02:93:dc:09:83:57:16:98:21:d0:42 + 8e:33:fc:48:69:e6:04:0d:4e:50:09:33 + 2e:28:60:4f:05:08:7c:ce:2f:a6:1a:4c + 41:d1:a3:dd:f6:37:56:44:1d:b0:54:af + f7:4a:a0:c2:19:5d:ce:62:b0:7a:1b:e1 + 5c:7f:bb:4d:7e:9e:28:48:00:a4:9a:86 + 3e:6e:6e:9c:57:41:c7:ec:bf:7f:09:fc + da:25:c2:1e:e0:52:dc:65:8c:40:a3:6e + bd:99:4e:0b:1a:04:e0:23:20:46:5a:d0 + 3f:b3:a4:d6:76:73:b7:cc:61:33:11:54 + a6:32:ff:94:08:d5:66:36:fd:99:69:21 + cc:28:5d:11:52:32:48:b6:a5:b5:c3:b0 + 21:3f:f9:69:25:83:b1:3d:79:a6:ed:ae + db:95:62:fc:72:ca:ad:46:fc:b6:b1:ea + 98:68:97:ba:f2:54:aa:86:ed:62:b1:78 + 5f:d5:19:80:ce:41:ee:98:a1:71:9f:fa + 5b:6b:d8:5e:7e:b3:18:0a:f0:4c:96:76 + 6c:0c:b0:a3 + + +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEAyekt/JQVGhBPPLUWfjQQfes91X1h/7DO2n9uDOrbtIf2xjSoPPiE +UhRZqxdc0PCGxAKT3AmDVxaYIdBCjjP8SGnmBA1OUAkzLihgTwUIfM4vphpMQdGj +3fY3VkQdsFSv90qgwhldzmKwehvhXH+7TX6eKEgApJqGPm5unFdBx+y/fwn82iXC +HuBS3GWMQKNuvZlOCxoE4CMgRlrQP7Ok1nZzt8xhMxFUpjL/lAjVZjb9mWkhzChd +EVIySLaltcOwIT/5aSWDsT15pu2u25Vi/HLKrUb8trHqmGiXuvJUqobtYrF4X9UZ +gM5B7pihcZ/6W2vYXn6zGArwTJZ2bAywowIBBQ== +-----END DH PARAMETERS----- Index: gnutls-2.4.1/tests/safe-renegotiation/srn0.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn0.c @@ -0,0 +1,338 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ../mini-x509-rehandshake.c. + * + * This tests that the safe renegotiation extension is negotiated + * properly by default on initial connections and on rehandshaked + * connections. Consequently, it also verifies that rehandshaked + * connections work with the extension enabled. + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL", NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL", NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (!gnutls_safe_renegotiation_status (client) || + !gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session not using safe renegotiation!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = 1; + + if (!gnutls_safe_renegotiation_status (client) || + !gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, + "Rehandshaked session not using safe renegotiation!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c @@ -0,0 +1,341 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ./srn0.c. + * + * This tests that clients without support for safe renegotiation is + * able to handshake against servers with support, but not able to + * rehandshake (server will refuse rehandshake). + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL", NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session using safe renegotiation but shouldn't?!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED) + break; + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS + && sret != GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED) + exit_code = 1; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Rehandshaked worked and uses safe reneg?!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn2.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn2.c @@ -0,0 +1,341 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ./srn1.c. + * + * This tests that clients with support for safe renegotiation is able + * to handshake against servers without support, but not able to + * rehandshake (client will refuse rehandshake). + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL", NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session using safe renegotiation but shouldn't?!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + + if (cret == GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED) + break; + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED + && sret != GNUTLS_E_SUCCESS) + exit_code = 1; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Rehandshaked worked and uses safe reneg?!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn3.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn3.c @@ -0,0 +1,264 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ../mini-x509.c. + * + * This tests that a %SAFE_RENEGOTIATION client will reject handshakes + * against servers that do not support the extension (server uses + * %DISABLE_SAFE_RENEGOTIATION). + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%SAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ((cret == GNUTLS_E_AGAIN || cret == GNUTLS_E_SUCCESS) + && (sret == GNUTLS_E_AGAIN || sret == GNUTLS_E_SUCCESS)); + + if (cret != GNUTLS_E_SAFE_RENEGOTIATION_FAILED && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn4.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn4.c @@ -0,0 +1,263 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ../mini-x509.c. + * + * This tests that a %SAFE_RENEGOTIATION server will reject handshakes + * against clients that do not support the extension. + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%SAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ((cret == GNUTLS_E_AGAIN || cret == GNUTLS_E_SUCCESS) + && (sret == GNUTLS_E_AGAIN || sret == GNUTLS_E_SUCCESS)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SAFE_RENEGOTIATION_FAILED) + exit_code = EXIT_FAILURE; + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn5.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn5.c @@ -0,0 +1,337 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ./srn0.c. + * + * This tests that a client with a permissive policy + * (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a + * server with no support for the extension. + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%UNSAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session using safe renegotiation?!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = 1; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Rehandshaked using safe renegotiation?!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn6.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn6.c @@ -0,0 +1,337 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ./srn5.c. + * + * This tests that a server with a permissive policy + * (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a + * client with no support for the extension. + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%UNSAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION", + NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session using safe renegotiation?!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = 1; + + if (gnutls_safe_renegotiation_status (client) || + gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Rehandshaked using safe renegotiation?!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/srn7.c =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/srn7.c @@ -0,0 +1,336 @@ +/* + * Copyright (C) 2008, 2010 Free Software Foundation, Inc. + * + * Author: Simon Josefsson + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Code based on ../srn0.c. + * + * This tests that clients and servers in %SAFE_RENEGOTIATION mode are + * able to handshake and rehandshake. + */ + +#ifdef HAVE_CONFIG_H +# include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <gnutls/gnutls.h> + + static void +tls_log_func (int level, const char *str) +{ + fprintf (stderr, "|<%d>| %s", level, str); +} + +static char *to_server; +static size_t to_server_len; + +static char *to_client; +static size_t to_client_len; + + static ssize_t +client_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_client_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_client, len); + + memmove (to_client, to_client + len, to_client_len - len); + to_client_len -= len; + + return len; +} + + static ssize_t +client_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_server_len + len; + char *tmp; + + tmp = realloc (to_server, newlen); + if (!tmp) + abort (); + to_server = tmp; + + memcpy (to_server + to_server_len, data, len); + to_server_len = newlen; + + return len; +} + + static ssize_t +server_pull (gnutls_transport_ptr_t tr, void *data, size_t len) +{ + if (to_server_len < len) + { + gnutls_transport_set_global_errno (EAGAIN); + return -1; + } + + memcpy (data, to_server, len); + + memmove (to_server, to_server + len, to_server_len - len); + to_server_len -= len; + + return len; +} + + static ssize_t +server_push (gnutls_transport_ptr_t tr, const void *data, size_t len) +{ + size_t newlen = to_client_len + len; + char *tmp; + + tmp = realloc (to_client, newlen); + if (!tmp) + abort (); + to_client = tmp; + + memcpy (to_client + to_client_len, data, len); + to_client_len = newlen; + + return len; +} + +static unsigned char server_cert_pem[] = +"-----BEGIN CERTIFICATE-----\n" +"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" +"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n" +"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n" +"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n" +"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n" +"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n" +"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n" +"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n" +"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n" +"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n" +"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n" +"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n" +"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n"; + +const gnutls_datum_t server_cert = { server_cert_pem, + sizeof (server_cert_pem) +}; + +static unsigned char server_key_pem[] = +"-----BEGIN RSA PRIVATE KEY-----\n" +"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n" +"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n" +"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n" +"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n" +"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n" +"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n" +"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n" +"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n" +"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n" +"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n" +"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n" +"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n" +"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n" +"-----END RSA PRIVATE KEY-----\n"; + +const gnutls_datum_t server_key = { server_key_pem, + sizeof (server_key_pem) +}; + + int +main (int argc, char *argv[]) +{ + int debug_level = argc - 1; + int exit_code = EXIT_SUCCESS; + /* Server stuff. */ + gnutls_certificate_credentials_t serverx509cred; + gnutls_session_t server; + int sret = GNUTLS_E_AGAIN; + /* Client stuff. */ + gnutls_certificate_credentials_t clientx509cred; + gnutls_session_t client; + int cret = GNUTLS_E_AGAIN; + + /* General init. */ + gnutls_global_init (); + gnutls_global_set_log_function (tls_log_func); + gnutls_global_set_log_level (debug_level); + + /* Init server */ + gnutls_certificate_allocate_credentials (&serverx509cred); + gnutls_certificate_set_x509_key_mem (serverx509cred, + &server_cert, &server_key, + GNUTLS_X509_FMT_PEM); + gnutls_init (&server, GNUTLS_SERVER); + gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred); + gnutls_priority_set_direct (server, "NORMAL:%SAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (server, server_push); + gnutls_transport_set_pull_function (server, server_pull); + + /* Init client */ + gnutls_certificate_allocate_credentials (&clientx509cred); + gnutls_init (&client, GNUTLS_CLIENT); + gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred); + gnutls_priority_set_direct (client, "NORMAL:%SAFE_RENEGOTIATION", NULL); + gnutls_transport_set_push_function (client, client_push); + gnutls_transport_set_pull_function (client, client_pull); + + /* Check that initially no session use the extension. */ + if (gnutls_safe_renegotiation_status (server) + || gnutls_safe_renegotiation_status (client)) + { + puts ("Client or server using extension before handshake?"); + abort (); + } + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = EXIT_FAILURE; + + if (!gnutls_safe_renegotiation_status (client) || + !gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, "Session not using safe renegotiation!\n"); + exit_code = EXIT_FAILURE; + } + + sret = gnutls_rehandshake (server); + if (debug_level > 0) + { + tls_log_func (0, "gnutls_rehandshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + + { + ssize_t n; + char b[1]; + n = gnutls_record_recv (client, b, 1); + if (n != GNUTLS_E_REHANDSHAKE) + abort (); + } + + cret = GNUTLS_E_AGAIN; + sret = GNUTLS_E_AGAIN; + + do + { + static int max_iter = 0; + if (max_iter++ > 10) + abort (); + + if (cret == GNUTLS_E_AGAIN) + { + cret = gnutls_handshake (client); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (client)...\n"); + tls_log_func (0, gnutls_strerror (cret)); + tls_log_func (0, "\n"); + } + } + + if (sret == GNUTLS_E_AGAIN) + { + sret = gnutls_handshake (server); + if (debug_level > 0) + { + tls_log_func (0, "second gnutls_handshake (server)...\n"); + tls_log_func (0, gnutls_strerror (sret)); + tls_log_func (0, "\n"); + } + } + } + while ( + /* Not done: */ + !(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS) + /* No error: */ + && (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN)); + + if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS) + exit_code = 1; + + if (!gnutls_safe_renegotiation_status (client) || + !gnutls_safe_renegotiation_status (server)) + { + tls_log_func (0, + "Rehandshaked session not using safe renegotiation!\n"); + exit_code = EXIT_FAILURE; + } + + gnutls_bye (client, GNUTLS_SHUT_RDWR); + gnutls_bye (server, GNUTLS_SHUT_RDWR); + + gnutls_deinit (client); + gnutls_deinit (server); + + free (to_server); + free (to_client); + + gnutls_certificate_free_credentials (serverx509cred); + + gnutls_global_deinit (); + + if (debug_level > 0) + { + if (exit_code == 0) + puts ("Self-test successful"); + else + puts ("Self-test failed"); + } + + return exit_code; +} Index: gnutls-2.4.1/tests/safe-renegotiation/testsrn =================================================================== --- /dev/null +++ gnutls-2.4.1/tests/safe-renegotiation/testsrn @@ -0,0 +1,103 @@ +#!/bin/sh + +# Copyright (C) 2010 Free Software Foundation, Inc. +# +# Author: Nikos Mavrogiannopoulos +# +# This file is part of GnuTLS. +# +# GnuTLS is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 3 of the License, or (at +# your option) any later version. +# +# GnuTLS is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with GnuTLS; if not, write to the Free Software Foundation, +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +srcdir="${srcdir:-.}" +SERV="${SERV:-../../src/gnutls-serv$EXEEXT} -q" +CLI="${CLI:-../../src/gnutls-cli$EXEEXT}" +PORT="${PORT:-5558}" +unset RETCODE + +fail() { + echo "Failure: $1" >&2 + RETCODE=${RETCODE:-${2:-1}} +} + +echo "Checking Safe renegotiation" + +$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%PARTIAL_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 & +pid=$! + +# give the server a chance to initialize +sleep 2 + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NONE:+AES-128-CBC:+MD5:+SHA1:+VERS-SSL3.0:+ANON-DH:+COMP-NULL:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "0. Renegotiation should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "1. Safe rehandshake should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "2. Unsafe rehandshake should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "3. Unsafe negotiation should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \ + fail "4. Unsafe renegotiation should have failed!" + + +kill $pid +wait + +$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 & +pid=$! + +# give the server a chance to initialize +sleep 2 + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "5. Safe rehandshake should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "6. Unsafe rehandshake should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \ + fail "7. Unsafe negotiation should have failed!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \ + fail "8. Unsafe renegotiation should have failed!" + +kill $pid +wait + +$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 & +pid=$! + +# give the server a chance to initialize +sleep 2 + +$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \ + fail "9. Initial connection should have failed!" + +$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "10. Unsafe connection should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "11. Unsafe negotiation should have succeeded!" + +$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \ + fail "12. Unsafe renegotiation should have succeeded!" + +kill $pid +wait + +exit ${RETCODE:-0} Index: gnutls-2.4.1/src/tests.c =================================================================== --- gnutls-2.4.1.orig/src/tests.c +++ gnutls-2.4.1/src/tests.c @@ -192,8 +192,6 @@ test_export (gnutls_session_t session) sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str); _gnutls_priority_set_direct (session, prio_str); - ADD_KX (session, GNUTLS_KX_RSA_EXPORT); - ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40); gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred); ret = do_handshake (session); Index: gnutls-2.4.1/configure.in =================================================================== --- gnutls-2.4.1.orig/configure.in +++ gnutls-2.4.1/configure.in @@ -687,7 +687,7 @@ AC_CONFIG_FILES([Makefile po/Makefile.in tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile \ tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile \ tests/pkcs12-decode/Makefile tests/pathlen/Makefile \ - tests/key-id/Makefile tests/sha2/Makefile \ + tests/key-id/Makefile tests/sha2/Makefile tests/safe-renegotiation/Makefile \ tests/hostname-check/Makefile \ includes/Makefile includes/gnutls/gnutls.h \ lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile \ Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.am =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.am +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.am @@ -18,12 +18,17 @@ # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS) -AM_CPPFLAGS = \ - -I$(top_srcdir)/lib/includes \ - -I$(top_builddir)/lib/includes +#AM_CPPFLAGS = \ +# -I$(top_srcdir)/lib/includes \ +# -I$(top_builddir)/lib/includes +AM_CPPFLAGS = -I$(top_srcdir)/includes -I$(top_builddir)/includes \ + -I$(top_srcdir)/tests AM_LDFLAGS = -no-install -LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) +#LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) +LDADD = -L$(top_builddir)/libextra -lgnutls-extra \ + -L$(top_builddir)/lib -lgnutls \ + -L$(top_builddir)/tests -lutils ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7 Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in @@ -879,12 +879,17 @@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS) -AM_CPPFLAGS = \ - -I$(top_srcdir)/lib/includes \ - -I$(top_builddir)/lib/includes +#AM_CPPFLAGS = \ +# -I$(top_srcdir)/lib/includes \ +# -I$(top_builddir)/lib/includes +AM_CPPFLAGS = -I$(top_srcdir)/includes -I$(top_builddir)/includes \ + -I$(top_srcdir)/tests AM_LDFLAGS = -no-install -LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) +#LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) +LDADD = -L$(top_builddir)/libextra -lgnutls-extra \ + -L$(top_builddir)/lib -lgnutls \ + -L$(top_builddir)/tests -lutils ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7 TESTS_ENVIRONMENT = $(VALGRIND) EXTRA_DIST = README params.dh Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in @@ -58,138 +58,138 @@ DIST_COMMON = README $(dist_check_SCRIPT $(srcdir)/Makefile.in ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/libextra/m4/hooks.m4 \ - $(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \ - $(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \ - $(top_srcdir)/gl/m4/arpa_inet_h.m4 \ - $(top_srcdir)/gl/m4/asm-underscore.m4 \ - $(top_srcdir)/gl/m4/autobuild.m4 \ - $(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \ - $(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \ - $(top_srcdir)/gl/m4/extensions.m4 \ - $(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \ - $(top_srcdir)/gl/m4/fseeko.m4 \ - $(top_srcdir)/gl/m4/getaddrinfo.m4 \ - $(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \ - $(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \ - $(top_srcdir)/gl/m4/gettimeofday.m4 \ - $(top_srcdir)/gl/m4/gnulib-common.m4 \ - $(top_srcdir)/gl/m4/gnulib-comp.m4 \ - $(top_srcdir)/gl/m4/hostent.m4 \ - $(top_srcdir)/gl/m4/include_next.m4 \ - $(top_srcdir)/gl/m4/inet_ntop.m4 \ - $(top_srcdir)/gl/m4/inet_pton.m4 \ - $(top_srcdir)/gl/m4/intmax_t.m4 \ - $(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \ - $(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \ - $(top_srcdir)/gl/m4/lib-prefix.m4 \ - $(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \ - $(top_srcdir)/gl/m4/malloc.m4 \ - $(top_srcdir)/gl/m4/manywarnings.m4 \ - $(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \ - $(top_srcdir)/gl/m4/mmap-anon.m4 \ - $(top_srcdir)/gl/m4/multiarch.m4 \ - $(top_srcdir)/gl/m4/netdb_h.m4 \ - $(top_srcdir)/gl/m4/netinet_in_h.m4 \ - $(top_srcdir)/gl/m4/onceonly_2_57.m4 \ - $(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \ - $(top_srcdir)/gl/m4/read-file.m4 \ - $(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \ - $(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \ - $(top_srcdir)/gl/m4/size_max.m4 \ - $(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \ - $(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \ - $(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \ - $(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \ - $(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \ - $(top_srcdir)/gl/m4/stdlib_h.m4 \ - $(top_srcdir)/gl/m4/strerror.m4 \ - $(top_srcdir)/gl/m4/string_h.m4 \ - $(top_srcdir)/gl/m4/sys_ioctl_h.m4 \ - $(top_srcdir)/gl/m4/sys_select_h.m4 \ - $(top_srcdir)/gl/m4/sys_socket_h.m4 \ - $(top_srcdir)/gl/m4/sys_stat_h.m4 \ - $(top_srcdir)/gl/m4/sys_time_h.m4 \ - $(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \ - $(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \ - $(top_srcdir)/gl/m4/valgrind-tests.m4 \ - $(top_srcdir)/gl/m4/vasnprintf.m4 \ - $(top_srcdir)/gl/m4/version-etc.m4 \ - $(top_srcdir)/gl/m4/warn-on-use.m4 \ - $(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \ - $(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \ - $(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \ - $(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \ - $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ - $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ - $(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac + $(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \ + $(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \ + $(top_srcdir)/gl/m4/arpa_inet_h.m4 \ + $(top_srcdir)/gl/m4/asm-underscore.m4 \ + $(top_srcdir)/gl/m4/autobuild.m4 \ + $(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \ + $(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \ + $(top_srcdir)/gl/m4/extensions.m4 \ + $(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \ + $(top_srcdir)/gl/m4/fseeko.m4 \ + $(top_srcdir)/gl/m4/getaddrinfo.m4 \ + $(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \ + $(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \ + $(top_srcdir)/gl/m4/gettimeofday.m4 \ + $(top_srcdir)/gl/m4/gnulib-common.m4 \ + $(top_srcdir)/gl/m4/gnulib-comp.m4 \ + $(top_srcdir)/gl/m4/hostent.m4 \ + $(top_srcdir)/gl/m4/include_next.m4 \ + $(top_srcdir)/gl/m4/inet_ntop.m4 \ + $(top_srcdir)/gl/m4/inet_pton.m4 \ + $(top_srcdir)/gl/m4/intmax_t.m4 \ + $(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \ + $(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \ + $(top_srcdir)/gl/m4/lib-prefix.m4 \ + $(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \ + $(top_srcdir)/gl/m4/malloc.m4 \ + $(top_srcdir)/gl/m4/manywarnings.m4 \ + $(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \ + $(top_srcdir)/gl/m4/mmap-anon.m4 \ + $(top_srcdir)/gl/m4/multiarch.m4 \ + $(top_srcdir)/gl/m4/netdb_h.m4 \ + $(top_srcdir)/gl/m4/netinet_in_h.m4 \ + $(top_srcdir)/gl/m4/onceonly_2_57.m4 \ + $(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \ + $(top_srcdir)/gl/m4/read-file.m4 \ + $(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \ + $(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \ + $(top_srcdir)/gl/m4/size_max.m4 \ + $(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \ + $(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \ + $(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \ + $(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \ + $(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \ + $(top_srcdir)/gl/m4/stdlib_h.m4 \ + $(top_srcdir)/gl/m4/strerror.m4 \ + $(top_srcdir)/gl/m4/string_h.m4 \ + $(top_srcdir)/gl/m4/sys_ioctl_h.m4 \ + $(top_srcdir)/gl/m4/sys_select_h.m4 \ + $(top_srcdir)/gl/m4/sys_socket_h.m4 \ + $(top_srcdir)/gl/m4/sys_stat_h.m4 \ + $(top_srcdir)/gl/m4/sys_time_h.m4 \ + $(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \ + $(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \ + $(top_srcdir)/gl/m4/valgrind-tests.m4 \ + $(top_srcdir)/gl/m4/vasnprintf.m4 \ + $(top_srcdir)/gl/m4/version-etc.m4 \ + $(top_srcdir)/gl/m4/warn-on-use.m4 \ + $(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \ + $(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \ + $(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \ + $(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \ + $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \ + $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \ + $(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ - $(ACLOCAL_M4) + $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__EXEEXT_1 = srn0$(EXEEXT) srn1$(EXEEXT) srn2$(EXEEXT) srn3$(EXEEXT) \ - srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT) + srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT) srn0_SOURCES = srn0.c srn0_OBJECTS = srn0.$(OBJEXT) srn0_LDADD = $(LDADD) am__DEPENDENCIES_1 = srn0_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn1_SOURCES = srn1.c srn1_OBJECTS = srn1.$(OBJEXT) srn1_LDADD = $(LDADD) srn1_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn2_SOURCES = srn2.c srn2_OBJECTS = srn2.$(OBJEXT) srn2_LDADD = $(LDADD) srn2_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn3_SOURCES = srn3.c srn3_OBJECTS = srn3.$(OBJEXT) srn3_LDADD = $(LDADD) srn3_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn4_SOURCES = srn4.c srn4_OBJECTS = srn4.$(OBJEXT) srn4_LDADD = $(LDADD) srn4_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn5_SOURCES = srn5.c srn5_OBJECTS = srn5.$(OBJEXT) srn5_LDADD = $(LDADD) srn5_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn6_SOURCES = srn6.c srn6_OBJECTS = srn6.$(OBJEXT) srn6_LDADD = $(LDADD) srn6_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) srn7_SOURCES = srn7.c srn7_OBJECTS = srn7.$(OBJEXT) srn7_LDADD = $(LDADD) srn7_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \ - $(am__DEPENDENCIES_1) + $(am__DEPENDENCIES_1) DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ - $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) + --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ + $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) CCLD = $(CC) LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ + --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ + $(LDFLAGS) -o $@ SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c DIST_SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c ETAGS = etags CTAGS = ctags am__tty_colors = \ - red=; grn=; lgn=; blu=; std= +red=; grn=; lgn=; blu=; std= DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ @@ -887,7 +887,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/includes - AM_LDFLAGS = -no-install #LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) -LDADD = -L$(top_builddir)/libextra -lgnutls-extra \ +LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) \ + -L$(top_builddir)/libextra -lgnutls-extra \ -L$(top_builddir)/lib -lgnutls \ -L$(top_builddir)/tests -lutils ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7 @@ -897,7 +898,7 @@ dist_check_SCRIPTS = testsrn all: all-am .SUFFIXES: - .SUFFIXES: .c .lo .o .obj +.SUFFIXES: .c .lo .o .obj $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ @@ -910,8 +911,8 @@ all: all-am echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile - .PRECIOUS: Makefile - Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ @@ -930,43 +931,43 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): clean-checkPROGRAMS: - @list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \ - echo " rm -f" $$list; \ - rm -f $$list || exit $$?; \ - test -n "$(EXEEXT)" || exit 0; \ - list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ - echo " rm -f" $$list; \ - rm -f $$list - srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) - @rm -f srn0$(EXEEXT) - $(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS) + @list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \ + echo " rm -f" $$list; \ + rm -f $$list || exit $$?; \ + test -n "$(EXEEXT)" || exit 0; \ + list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ + echo " rm -f" $$list; \ + rm -f $$list +srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) + @rm -f srn0$(EXEEXT) + $(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS) srn1$(EXEEXT): $(srn1_OBJECTS) $(srn1_DEPENDENCIES) - @rm -f srn1$(EXEEXT) - $(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS) + @rm -f srn1$(EXEEXT) + $(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS) srn2$(EXEEXT): $(srn2_OBJECTS) $(srn2_DEPENDENCIES) - @rm -f srn2$(EXEEXT) - $(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS) + @rm -f srn2$(EXEEXT) + $(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS) srn3$(EXEEXT): $(srn3_OBJECTS) $(srn3_DEPENDENCIES) - @rm -f srn3$(EXEEXT) - $(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS) + @rm -f srn3$(EXEEXT) + $(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS) srn4$(EXEEXT): $(srn4_OBJECTS) $(srn4_DEPENDENCIES) - @rm -f srn4$(EXEEXT) - $(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS) + @rm -f srn4$(EXEEXT) + $(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS) srn5$(EXEEXT): $(srn5_OBJECTS) $(srn5_DEPENDENCIES) - @rm -f srn5$(EXEEXT) - $(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS) + @rm -f srn5$(EXEEXT) + $(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS) srn6$(EXEEXT): $(srn6_OBJECTS) $(srn6_DEPENDENCIES) - @rm -f srn6$(EXEEXT) - $(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS) + @rm -f srn6$(EXEEXT) + $(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS) srn7$(EXEEXT): $(srn7_OBJECTS) $(srn7_DEPENDENCIES) - @rm -f srn7$(EXEEXT) - $(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS) + @rm -f srn7$(EXEEXT) + $(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS) mostlyclean-compile: - -rm -f *.$(OBJEXT) + -rm -f *.$(OBJEXT) distclean-compile: - -rm -f *.tab.c + -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn0.Po@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn1.Po@am__quote@ @@ -978,25 +979,25 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn7.Po@am__quote@ .c.o: - @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< - @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po - @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ - @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ - @am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c $< .c.obj: - @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` - @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po - @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ - @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ - @am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: - @am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< - @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo - @AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ - @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ - @am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo @@ -1178,28 +1179,28 @@ distdir: $(DISTFILES) || exit 1; \ fi; \ done - check-am: all-am +check-am: all-am $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) \ - $(dist_check_SCRIPTS) + $(dist_check_SCRIPTS) $(MAKE) $(AM_MAKEFLAGS) check-TESTS - check: check-am - all-am: Makefile +check: check-am +all-am: Makefile installdirs: - install: install-am - install-exec: install-exec-am - install-data: install-data-am - uninstall: uninstall-am +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am - install-strip: +install-strip: $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ `test -z '$(STRIP)' || \ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install - mostlyclean-generic: +mostlyclean-generic: clean-generic: @@ -1210,7 +1211,7 @@ distclean-generic: maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." - clean: clean-am +clean: clean-am clean-am: clean-checkPROGRAMS clean-generic clean-libtool \ mostlyclean-am @@ -1218,7 +1219,7 @@ clean-am: clean-checkPROGRAMS clean-gene distclean: distclean-am -rm -rf ./$(DEPDIR) -rm -f Makefile - distclean-am: clean-am distclean-compile distclean-generic \ +distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags dvi: dvi-am @@ -1264,7 +1265,7 @@ installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) -rm -f Makefile - maintainer-clean-am: distclean-am maintainer-clean-generic +maintainer-clean-am: distclean-am maintainer-clean-generic mostlyclean: mostlyclean-am Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in +++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in @@ -1059,95 +1059,96 @@ distclean-tags: check-TESTS: $(TESTS) @failed=0; all=0; xfail=0; xpass=0; skip=0; \ - srcdir=$(srcdir); export srcdir; \ - list=' $(TESTS) '; \ - $(am__tty_colors); \ - if test -n "$$list"; then \ + srcdir=$(srcdir); export srcdir; \ + list=' $(TESTS) '; \ + $(am__tty_colors); \ + if test -n "$$list"; then \ for tst in $$list; do \ - if test -f ./$$tst; then dir=./; \ - elif test -f $$tst; then dir=; \ - else dir="$(srcdir)/"; fi; \ - if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \ - all=`expr $$all + 1`; \ - case " $(XFAIL_TESTS) " in \ - *[\ \ ]$$tst[\ \ ]*) \ - xpass=`expr $$xpass + 1`; \ - failed=`expr $$failed + 1`; \ - col=$$red; res=XPASS; \ - ;; \ - *) \ - col=$$grn; res=PASS; \ - ;; \ - esac; \ - elif test $$? -ne 77; then \ - all=`expr $$all + 1`; \ - case " $(XFAIL_TESTS) " in \ - *[\ \ ]$$tst[\ \ ]*) \ - xfail=`expr $$xfail + 1`; \ - col=$$lgn; res=XFAIL; \ - ;; \ - *) \ - failed=`expr $$failed + 1`; \ - col=$$red; res=FAIL; \ - ;; \ - esac; \ - else \ - skip=`expr $$skip + 1`; \ - col=$$blu; res=SKIP; \ - fi; \ - echo "$${col}$$res$${std}: $$tst"; \ + echo "test---------$$tst" + if test -f ./$$tst; then dir=./; \ + elif test -f $$tst; then dir=; \ + else dir="$(srcdir)/"; fi; \ + if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *[\ \ ]$$tst[\ \ ]*) \ + xpass=`expr $$xpass + 1`; \ + failed=`expr $$failed + 1`; \ + col=$$red; res=XPASS; \ + ;; \ + *) \ + col=$$grn; res=PASS; \ + ;; \ + esac; \ + elif test $$? -ne 77; then \ + all=`expr $$all + 1`; \ + case " $(XFAIL_TESTS) " in \ + *[\ \ ]$$tst[\ \ ]*) \ + xfail=`expr $$xfail + 1`; \ + col=$$lgn; res=XFAIL; \ + ;; \ + *) \ + failed=`expr $$failed + 1`; \ + col=$$red; res=FAIL; \ + ;; \ + esac; \ + else \ + skip=`expr $$skip + 1`; \ + col=$$blu; res=SKIP; \ + fi; \ + echo "$${col}$$res$${std}: $$tst"; \ done; \ if test "$$all" -eq 1; then \ - tests="test"; \ - All=""; \ - else \ - tests="tests"; \ - All="All "; \ - fi; \ - if test "$$failed" -eq 0; then \ - if test "$$xfail" -eq 0; then \ - banner="$$All$$all $$tests passed"; \ - else \ - if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \ - banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \ - fi; \ - else \ - if test "$$xpass" -eq 0; then \ - banner="$$failed of $$all $$tests failed"; \ - else \ - if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \ - banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \ - fi; \ - fi; \ - dashes="$$banner"; \ - skipped=""; \ - if test "$$skip" -ne 0; then \ - if test "$$skip" -eq 1; then \ - skipped="($$skip test was not run)"; \ - else \ - skipped="($$skip tests were not run)"; \ - fi; \ - test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \ - dashes="$$skipped"; \ - fi; \ - report=""; \ - if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \ - report="Please report to $(PACKAGE_BUGREPORT)"; \ - test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \ - dashes="$$report"; \ - fi; \ - dashes=`echo "$$dashes" | sed s/./=/g`; \ - if test "$$failed" -eq 0; then \ - echo "$$grn$$dashes"; \ - else \ - echo "$$red$$dashes"; \ - fi; \ - echo "$$banner"; \ - test -z "$$skipped" || echo "$$skipped"; \ - test -z "$$report" || echo "$$report"; \ - echo "$$dashes$$std"; \ - test "$$failed" -eq 0; \ - else :; fi + tests="test"; \ + All=""; \ + else \ + tests="tests"; \ + All="All "; \ + fi; \ + if test "$$failed" -eq 0; then \ + if test "$$xfail" -eq 0; then \ + banner="$$All$$all $$tests passed"; \ + else \ + if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \ + banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \ + fi; \ + else \ + if test "$$xpass" -eq 0; then \ + banner="$$failed of $$all $$tests failed"; \ + else \ + if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \ + banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \ + fi; \ + fi; \ + dashes="$$banner"; \ + skipped=""; \ + if test "$$skip" -ne 0; then \ + if test "$$skip" -eq 1; then \ + skipped="($$skip test was not run)"; \ + else \ + skipped="($$skip tests were not run)"; \ + fi; \ + test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$skipped"; \ + fi; \ + report=""; \ + if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \ + report="Please report to $(PACKAGE_BUGREPORT)"; \ + test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \ + dashes="$$report"; \ + fi; \ + dashes=`echo "$$dashes" | sed s/./=/g`; \ + if test "$$failed" -eq 0; then \ + echo "$$grn$$dashes"; \ + else \ + echo "$$red$$dashes"; \ + fi; \ + echo "$$banner"; \ + test -z "$$skipped" || echo "$$skipped"; \ + test -z "$$report" || echo "$$report"; \ + echo "$$dashes$$std"; \ + test "$$failed" -eq 0; \ + else :; fi distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c +++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c @@ -74,7 +74,10 @@ client_push (gnutls_transport_ptr_t tr, tmp = realloc (to_server, newlen); if (!tmp) + { + puts ("1Client or server using extension before handshake?"); abort (); + } to_server = tmp; memcpy (to_server + to_server_len, data, len); @@ -108,7 +111,10 @@ server_push (gnutls_transport_ptr_t tr, tmp = realloc (to_client, newlen); if (!tmp) + { + puts ("2Client or server using extension before handshake?"); abort (); + } to_client = tmp; memcpy (to_client + to_client_len, data, len); @@ -197,6 +203,7 @@ main (int argc, char *argv[]) gnutls_transport_set_push_function (client, client_push); gnutls_transport_set_pull_function (client, client_pull); + puts ("3Client or server using extension before handshake?"); /* Check that initially no session use the extension. */ if (gnutls_safe_renegotiation_status (server) || gnutls_safe_renegotiation_status (client)) @@ -204,12 +211,16 @@ main (int argc, char *argv[]) puts ("Client or server using extension before handshake?"); abort (); } + puts ("4Client or server using extension before handshake?"); do { static int max_iter = 0; if (max_iter++ > 10) + { + puts ("5Client or server using extension before handshake?"); abort (); + } if (cret == GNUTLS_E_AGAIN) { @@ -262,7 +273,10 @@ main (int argc, char *argv[]) char b[1]; n = gnutls_record_recv (client, b, 1); if (n != GNUTLS_E_REHANDSHAKE) + { + puts ("6Client or server using extension before handshake?"); abort (); + } } cret = GNUTLS_E_AGAIN; @@ -272,7 +286,10 @@ main (int argc, char *argv[]) { static int max_iter = 0; if (max_iter++ > 10) + { + puts ("7Client or server using extension before handshake?"); abort (); + } if (cret == GNUTLS_E_AGAIN) { Index: gnutls-2.4.1/src/tests.c =================================================================== --- gnutls-2.4.1.orig/src/tests.c +++ gnutls-2.4.1/src/tests.c @@ -106,11 +106,6 @@ do_handshake (gnutls_session_t session) char protocol_str[] = "+VERS-TLS1.0:+VERS-SSL3.0"; char prio_str[256] = ""; -static const int kx_priority[16] = - { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA, - GNUTLS_KX_ANON_DH, - GNUTLS_KX_RSA_EXPORT, 0 -}; #define ALL_CIPHERS "+3DES-CBC:+ARCFOUR-128:+ARCFOUR-40" #define ALL_COMP "+COMP-NULL" #define ALL_MACS "+SHA1:+MD5" Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c +++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c @@ -225,6 +225,7 @@ main (int argc, char *argv[]) if (cret == GNUTLS_E_AGAIN) { cret = gnutls_handshake (client); + printf ("cret: %d", cret); if (debug_level > 0) { tls_log_func (0, "gnutls_handshake (client)...\n"); @@ -236,6 +237,7 @@ main (int argc, char *argv[]) if (sret == GNUTLS_E_AGAIN) { sret = gnutls_handshake (server); + printf ("sret: %d", sret); if (debug_level > 0) { tls_log_func (0, "gnutls_handshake (server)...\n"); Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c +++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c @@ -222,10 +222,10 @@ main (int argc, char *argv[]) abort (); } + printf ("cret: %d | sret: %d \n", cret, sret); if (cret == GNUTLS_E_AGAIN) { cret = gnutls_handshake (client); - printf ("cret: %d", cret); if (debug_level > 0) { tls_log_func (0, "gnutls_handshake (client)...\n"); @@ -237,7 +237,6 @@ main (int argc, char *argv[]) if (sret == GNUTLS_E_AGAIN) { sret = gnutls_handshake (server); - printf ("sret: %d", sret); if (debug_level > 0) { tls_log_func (0, "gnutls_handshake (server)...\n"); Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -2469,22 +2469,27 @@ gnutls_handshake (gnutls_session_t sessi { int ret; + puts("handshake--1"); if ((ret = _gnutls_handshake_hash_init (session)) < 0) { gnutls_assert (); return ret; } + puts("handshake--2"); if (session->security_parameters.entity == GNUTLS_CLIENT) { + puts("handshake--3"); ret = _gnutls_handshake_client (session); } else { + puts("handshake--4"); ret = _gnutls_handshake_server (session); } if (ret < 0) { + puts("handshake--5"); /* In the case of a rehandshake abort * we should reset the handshake's internal state. */ @@ -2494,16 +2499,19 @@ gnutls_handshake (gnutls_session_t sessi return ret; } + puts("handshake--6"); ret = _gnutls_handshake_common (session); if (ret < 0) { + puts("handshake--7"); if (_gnutls_abort_handshake (session, ret) == 0) STATE = STATE0; return ret; } + puts("handshake--8"); STATE = STATE0; _gnutls_handshake_io_buffer_clear (session); Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -54,6 +54,9 @@ #include <auth_psk.h> /* for gnutls_psk_server_credentials_t */ #include <gc.h> #include <random.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> #ifdef HANDSHAKE_DEBUG #define ERR(x, y) _gnutls_handshake_log( "HSK[%x]: %s (%d)\n", session, x,y) Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1860,12 +1860,14 @@ _gnutls_send_client_hello (gnutls_sessio hver = session->internals.resumed_security_parameters.version; } + puts("1111111111111111111111111"); if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0) { gnutls_assert (); gnutls_free (data); return GNUTLS_E_INTERNAL_ERROR; } + puts("2222222222222222222222222"); data[pos++] = _gnutls_version_get_major (hver); data[pos++] = _gnutls_version_get_minor (hver); Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1825,12 +1825,16 @@ _gnutls_send_client_hello (gnutls_sessio opaque rnd[TLS_RANDOM_SIZE]; gnutls_protocol_t hver; opaque extdata[MAX_EXT_DATA_LENGTH]; + int rehandshake = 0; opaque *SessionID = session->internals.resumed_security_parameters.session_id; uint8_t session_id_len = session->internals.resumed_security_parameters.session_id_size; + if (session->security_parameters.session_id_size) + rehandshake = 1; + if (SessionID == NULL) session_id_len = 0; else if (session_id_len == 0) @@ -1854,7 +1858,13 @@ _gnutls_send_client_hello (gnutls_sessio * version number to the previously established. */ if (SessionID == NULL) - hver = _gnutls_version_max (session); + { + if (rehandshake) /* already negotiated version thus version_max == negotiated version */ + hver = session->security_parameters.version; + else + + hver = _gnutls_version_max (session); + } else { /* we are resuming a session */ hver = session->internals.resumed_security_parameters.version; Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1871,6 +1871,7 @@ _gnutls_send_client_hello (gnutls_sessio } puts("1111111111111111111111111"); + printf("version info: %d | GNUTLS_SSL3 :1 |GNUTLS_TLS1_0|GNUTLS_TLS1_1|GNUTLS_TLS1_2|GNUTLS_VERSION_UNKNOWN : 0xff| \n",(int)hver); if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0) { gnutls_assert (); Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1860,10 +1860,15 @@ _gnutls_send_client_hello (gnutls_sessio if (SessionID == NULL) { if (rehandshake) /* already negotiated version thus version_max == negotiated version */ + { hver = session->security_parameters.version; + printf("session->security_parameters.version: %d\n",session->security_parameters.version); + } else - + { hver = _gnutls_version_max (session); + printf("_gnutls_version_max: %d\n", hver); + } } else { /* we are resuming a session */ Index: gnutls-2.4.1/lib/gnutls_priority.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_priority.c +++ gnutls-2.4.1/lib/gnutls_priority.c @@ -654,12 +654,42 @@ gnutls_priority_init (gnutls_priority_t goto error; } else if (broken_list[i][0] == '%') - { - if (strcasecmp (&broken_list[i][1], "COMPAT") == 0) - (*priority_cache)->no_padding = 1; - else - goto error; - } + { + if (strcasecmp (&broken_list[i][1], "COMPAT") == 0) + (*priority_cache)->no_padding = 1; + else if (strcasecmp (&broken_list[i][1], + "VERIFY_ALLOW_SIGN_RSA_MD5") == 0) + (*priority_cache)->additional_verify_flags |= + GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5; + else if (strcasecmp (&broken_list[i][1], + "SSL3_RECORD_VERSION") == 0) + (*priority_cache)->ssl3_record_version = 1; + else if (strcasecmp (&broken_list[i][1], + "VERIFY_ALLOW_X509_V1_CA_CRT") == 0) + (*priority_cache)->additional_verify_flags |= + GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT; + else if (strcasecmp (&broken_list[i][1], + "UNSAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_UNSAFE; + } + else if (strcasecmp (&broken_list[i][1], "SAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_SAFE; + } + else if (strcasecmp (&broken_list[i][1], + "PARTIAL_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_PARTIAL; + } + else if (strcasecmp (&broken_list[i][1], + "DISABLE_SAFE_RENEGOTIATION") == 0) + { + (*priority_cache)->sr = SR_DISABLED; + } + else + goto error; + } else goto error; } Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1893,15 +1893,24 @@ _gnutls_send_client_hello (gnutls_sessio */ _gnutls_set_adv_version (session, hver); - /* Some old implementations do not interoperate if we send a - * different version in the record layer. - * It seems they prefer to read the record's version - * as the one we actually requested. - * The proper behaviour is to use the one in the client hello - * handshake packet and ignore the one in the packet's record - * header. - */ - _gnutls_set_current_version (session, hver); + if (session->internals.priorities.ssl3_record_version) + { + /* Honor the SSL3_RECORD_VERSION option + * */ + _gnutls_set_current_version (session, GNUTLS_SSL3); + } + else + { + /* Some old implementations do not interoperate if we send a + * different version in the record layer. + * It seems they prefer to read the record's version + * as the one we actually requested. + * The proper behaviour is to use the one in the client hello + * handshake packet and ignore the one in the packet's record + * header. + */ + _gnutls_set_current_version (session, hver); + } /* In order to know when this session was initiated. */ Index: gnutls-2.4.1/lib/gnutls_int.h =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_int.h +++ gnutls-2.4.1/lib/gnutls_int.h @@ -428,6 +428,8 @@ struct gnutls_priority_st /* to disable record padding */ int no_padding:1; safe_renegotiation_t sr; + int ssl3_record_version; + int additional_verify_flags; }; Index: gnutls-2.4.1/lib/gnutls_x509.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_x509.c +++ gnutls-2.4.1/lib/gnutls_x509.c @@ -178,7 +178,7 @@ _gnutls_x509_cert_verify_peers (gnutls_s peer_certificate_list_size, cred->x509_ca_list, cred->x509_ncas, cred->x509_crl_list, cred->x509_ncrls, - cred->verify_flags, status); + cred->verify_flags| session->internals.priorities.additional_verify_flags, status); CLEAR_CERTS; cta: command not found cta: command not found Index: gnutls-2.4.1/lib/gnutls_handshake.c =================================================================== --- gnutls-2.4.1.orig/lib/gnutls_handshake.c +++ gnutls-2.4.1/lib/gnutls_handshake.c @@ -1862,12 +1862,10 @@ _gnutls_send_client_hello (gnutls_sessio if (rehandshake) /* already negotiated version thus version_max == negotiated version */ { hver = session->security_parameters.version; - printf("session->security_parameters.version: %d\n",session->security_parameters.version); } else { hver = _gnutls_version_max (session); - printf("_gnutls_version_max: %d\n", hver); } } else @@ -1875,15 +1873,12 @@ _gnutls_send_client_hello (gnutls_sessio hver = session->internals.resumed_security_parameters.version; } - puts("1111111111111111111111111"); - printf("version info: %d | GNUTLS_SSL3 :1 |GNUTLS_TLS1_0|GNUTLS_TLS1_1|GNUTLS_TLS1_2|GNUTLS_VERSION_UNKNOWN : 0xff| \n",(int)hver); if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0) { gnutls_assert (); gnutls_free (data); return GNUTLS_E_INTERNAL_ERROR; } - puts("2222222222222222222222222"); data[pos++] = _gnutls_version_get_major (hver); data[pos++] = _gnutls_version_get_minor (hver); @@ -2499,27 +2494,22 @@ gnutls_handshake (gnutls_session_t sessi { int ret; - puts("handshake--1"); if ((ret = _gnutls_handshake_hash_init (session)) < 0) { gnutls_assert (); return ret; } - puts("handshake--2"); if (session->security_parameters.entity == GNUTLS_CLIENT) { - puts("handshake--3"); ret = _gnutls_handshake_client (session); } else { - puts("handshake--4"); ret = _gnutls_handshake_server (session); } if (ret < 0) { - puts("handshake--5"); /* In the case of a rehandshake abort * we should reset the handshake's internal state. */ @@ -2529,19 +2519,16 @@ gnutls_handshake (gnutls_session_t sessi return ret; } - puts("handshake--6"); ret = _gnutls_handshake_common (session); if (ret < 0) { - puts("handshake--7"); if (_gnutls_abort_handshake (session, ret) == 0) STATE = STATE0; return ret; } - puts("handshake--8"); STATE = STATE0; _gnutls_handshake_io_buffer_clear (session); Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c =================================================================== --- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c +++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c @@ -75,7 +75,6 @@ client_push (gnutls_transport_ptr_t tr, tmp = realloc (to_server, newlen); if (!tmp) { - puts ("1Client or server using extension before handshake?"); abort (); } to_server = tmp; @@ -112,7 +111,6 @@ server_push (gnutls_transport_ptr_t tr, tmp = realloc (to_client, newlen); if (!tmp) { - puts ("2Client or server using extension before handshake?"); abort (); } to_client = tmp; @@ -203,7 +201,6 @@ main (int argc, char *argv[]) gnutls_transport_set_push_function (client, client_push); gnutls_transport_set_pull_function (client, client_pull); - puts ("3Client or server using extension before handshake?"); /* Check that initially no session use the extension. */ if (gnutls_safe_renegotiation_status (server) || gnutls_safe_renegotiation_status (client)) @@ -211,18 +208,15 @@ main (int argc, char *argv[]) puts ("Client or server using extension before handshake?"); abort (); } - puts ("4Client or server using extension before handshake?"); do { static int max_iter = 0; if (max_iter++ > 10) { - puts ("5Client or server using extension before handshake?"); abort (); } - printf ("cret: %d | sret: %d \n", cret, sret); if (cret == GNUTLS_E_AGAIN) { cret = gnutls_handshake (client); @@ -275,7 +269,6 @@ main (int argc, char *argv[]) n = gnutls_record_recv (client, b, 1); if (n != GNUTLS_E_REHANDSHAKE) { - puts ("6Client or server using extension before handshake?"); abort (); } } @@ -288,7 +281,6 @@ main (int argc, char *argv[]) static int max_iter = 0; if (max_iter++ > 10) { - puts ("7Client or server using extension before handshake?"); abort (); }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
