safe renegotiation self checks
Simon Josefsson
simon at josefsson.org
Mon Jun 7 15:15:57 CEST 2010
On the gnutls_2_10_x branch I have fixed so that we have the self-tests
for safe renegotiation described below. Are there more cases that we
want to test? Review welcome, it is easy to go code blind with this
complexity. Code is available from:
http://git.savannah.gnu.org/cgit/gnutls.git/tree/tests/safe-renegotiation?h=gnutls_2_10_x
/Simon
Testing safe renegotiation is relatively complex, here is a summary of
what we test and what how we believe it should work.
Client setting
Server setting
Initial handshake outcome
Rehandshake outcome
srn0.c
This tests that the safe renegotiation extension is negotiated
properly by default on initial connections and on rehandshaked
connections. Consequently, it also verifies that rehandshaked
connections work with the extension enabled.
NORMAL
NORMAL
OK
OK
srn1.c
This tests that clients without support for safe renegotiation is
able to handshake against servers with support, but not able to
rehandshake (server will refuse rehandshake).
NORMAL:%DISABLE_SAFE_RENEGOTIATION
NORMAL
OK
Server refuses
srn2.c
This tests that clients with support for safe renegotiation is able
to handshake against servers without support, but not able to
rehandshake (client will refuse rehandshake).
NORMAL
NORMAL:%DISABLE_SAFE_RENEGOTIATION
OK
Client refuses
srn3.c
This tests that a %SAFE_RENEGOTIATION client will reject handshakes
against servers that do not support the extension (server uses
%DISABLE_SAFE_RENEGOTIATION).
NORMAL:%SAFE_RENEGOTIATION
NORMAL:%DISABLE_SAFE_RENEGOTIATION
Client refuses
N/A
srn4.c
This tests that a %SAFE_RENEGOTIATION server will reject handshakes
against clients that do not support the extension.
NORMAL:%DISABLE_SAFE_RENEGOTIATION
NORMAL:%SAFE_RENEGOTIATION
Server refuses
N/A
srn5.c
This tests that a client with a permissive policy
(%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
server with no support for the extension.
NORMAL:%DISABLE_SAFE_RENEGOTIATION
NORMAL:%UNSAFE_RENEGOTIATION
OK
OK
srn6.c
This tests that a server with a permissive policy
(%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
client with no support for the extension.
NORMAL:%UNSAFE_RENEGOTIATION
NORMAL:%DISABLE_SAFE_RENEGOTIATION
OK
OK
srn7.c
This tests that clients and servers in %SAFE_RENEGOTIATION mode are
able to handshake and rehandshake.
NORMAL:%SAFE_RENEGOTIATION
NORMAL:%SAFE_RENEGOTIATION
OK
OK
More information about the Gnutls-devel
mailing list