gnutls-cli-debug: check if %ALLOW_SMALL_RECORDS is required

This adds a new test against the server to check if
%ALLOW_SMALL_RECORDS is required to continue communicating with the
server.  The test is in two parts: one to check if the server accepts
records with the default size (512 bytes) and the other is to check if
%ALLOW_SMALL_RECORDS helps if the previuos test fails.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

diff --git a/src/cli-debug.c b/src/cli-debug.c
index 8308b9b48f54689a1f5d55c468005d2e2504f7c2..c1333b193582f598f4b1b5500f66f75bb8a93e9b 100644 (file)
--- a/src/cli-debug.c
+++ b/src/cli-debug.c
@@ -83,6 +83,10 @@ typedef struct {
 } TLS_TEST;
 
 static const TLS_TEST tls_tests[] = {
+       {"whether the server accepts default record size (512 bytes)",
+        test_send_record, "yes", "no", "dunno"},
+       {"whether %ALLOW_SMALL_RECORDS is required",
+        test_send_record_with_allow_small_records, "yes", "no", "dunno"},
 #ifdef ENABLE_SSL3
        {"for SSL 3.0 (RFC6101) support", test_ssl3, "yes", "no", "dunno"},
        /* The following tests will disable TLS 1.x if the server is
@@ -94,9 +98,9 @@ static const TLS_TEST tls_tests[] = {
         "yes", "dunno"},
        {"whether we need to disable TLS 1.0", test_tls_disable0, "no",
         "yes", "dunno"},
-       {"whether \%NO_EXTENSIONS is required", test_no_extensions, "no", "yes",
+       {"whether %NO_EXTENSIONS is required", test_no_extensions, "no", "yes",
         "dunno"},
-       {"whether \%COMPAT is required", test_record_padding, "no", "yes",
+       {"whether %COMPAT is required", test_record_padding, "no", "yes",
         "dunno"},
        {"for TLS 1.0 (RFC2246) support", test_tls1, "yes", "no", "dunno"},
        {"for TLS 1.0 (RFC2246) support with TLS 1.0 record version", test_tls1_nossl3, "yes", "no", "dunno"},

diff --git a/src/tests.c b/src/tests.c
index 3073beae56c7b92c6f40105698ac379b1c1b4605..115f3ae82b48eb9a9ac81faa02d45118d5a3345d 100644 (file)
--- a/src/tests.c
+++ b/src/tests.c
@@ -57,6 +57,7 @@ int ssl3_ok = 0;
 int tls1_1_ok = 0;
 int tls1_2_ok = 0;
 int tls1_3_ok = 0;
+int send_record_ok = 0;
 
 /* keep session info */
 static char *session_data = NULL;
@@ -1518,3 +1519,63 @@ test_code_t test_server_cas(gnutls_session_t session)
                ext_text = "none";
        return TEST_SUCCEED;
 }
+
+static test_code_t
+test_do_handshake_and_send_record(gnutls_session_t session)
+{
+       int ret;
+       /* This will be padded to 512 bytes. */
+       const char snd_buf[] = "GET / HTTP/1.0\r\n\r\n";
+       static char buf[5 * 1024];
+
+       ret = test_do_handshake(session);
+       if (ret != TEST_SUCCEED)
+               return ret;
+
+       gnutls_record_send(session, snd_buf, sizeof(snd_buf) - 1);
+       ret = gnutls_record_recv(session, buf, sizeof(buf) - 1);
+       if (ret < 0)
+               return TEST_FAILED;
+
+       return TEST_SUCCEED;
+}
+
+/* These tests shall be sent in this order to check if the server
+ * advertises smaller limits than our default 512. and we can work it
+ * around with %ALLOW_SMALL_RECORDS. */
+test_code_t test_send_record(gnutls_session_t session)
+{
+       int ret;
+
+       sprintf(prio_str,
+               INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+               ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+       _gnutls_priority_set_direct(session, prio_str);
+       gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+       ret = test_do_handshake_and_send_record(session);
+       if (ret == TEST_SUCCEED)
+               send_record_ok = 1;
+       return ret;
+}
+
+test_code_t test_send_record_with_allow_small_records(gnutls_session_t session)
+{
+       int ret;
+
+       /* If test_send_record succeeded, we don't need to check. */
+       if (send_record_ok)
+               return TEST_FAILED;
+
+       sprintf(prio_str,
+               INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+               ALL_MACS ":" ALL_KX ":%%ALLOW_SMALL_RECORDS:%s",
+               protocol_str, rest);
+       _gnutls_priority_set_direct(session, prio_str);
+       gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+       ret = test_do_handshake_and_send_record(session);
+       if (ret == TEST_SUCCEED)
+               strcat(rest, ":%ALLOW_SMALL_RECORDS");
+       return ret;
+}

diff --git a/src/tests.h b/src/tests.h
index 098c441a8d201662bd0b61bd17cd736a05c6ad41..0e6ad1824a3a31dfd8e26bc072909ff010de609e 100644 (file)
--- a/src/tests.h
+++ b/src/tests.h
@@ -70,6 +70,8 @@ test_code_t test_server_cas(gnutls_session_t state);
 test_code_t test_session_resume2(gnutls_session_t state);
 test_code_t test_rsa_pms_version_check(gnutls_session_t session);
 test_code_t test_version_oob(gnutls_session_t session);
+test_code_t test_send_record(gnutls_session_t session);
+test_code_t test_send_record_with_allow_small_records(gnutls_session_t session);
 int _test_srp_username_callback(gnutls_session_t session,
                                char **username, char **password);
 

diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh
index 191096ce6c4815e71972b8e031363d63c4b8a4b6..2de64b9a4196c27f1f476cdc936956f5be8b4cad 100755 (executable)
--- a/tests/gnutls-cli-debug.sh
+++ b/tests/gnutls-cli-debug.sh
@@ -142,4 +142,25 @@ fi
 
 rm -f ${OUTFILE}
 
+# Small records test
+echo ""
+echo "Checking output of gnutls-cli-debug for small records"
+
+eval "${GETPORT}"
+launch_server $$ --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2:%ALLOW_SMALL_RECORDS" --x509keyfile ${KEY1} --x509certfile ${CERT1} \
+       --x509keyfile ${KEY2} --x509certfile ${CERT2} --x509keyfile ${KEY3} --x509certfile ${CERT3} --recordsize=64 >/dev/null 2>&1
+PID=$!
+wait_server ${PID}
+
+timeout 1800 datefudge "2017-08-9" \
+"${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+
+kill ${PID}
+wait
+
+check_text "whether the server accepts default record size (512 bytes)... no"
+check_text "whether %ALLOW_SMALL_RECORDS is required... yes"
+
+rm -f ${OUTFILE}
+
 exit 0