Add tests for renego security enforcement
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 4eafed4..bd98bdb 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -20,7 +20,7 @@
O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key"
O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client"
G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
-G_CLI="$GNUTLS_CLI"
+G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt"
TESTS=0
FAILS=0
@@ -364,7 +364,7 @@
O_SRV="$O_SRV -accept $PORT"
O_CLI="$O_CLI -connect localhost:$PORT"
G_SRV="$G_SRV -p $PORT"
-G_CLI="$G_CLI -p $PORT"
+G_CLI="$G_CLI -p $PORT localhost"
# Also pick a unique name for intermediate files
SRV_OUT="srv_out.$$"
@@ -803,21 +803,103 @@
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate" \
- -C "ssl_handshake returned" \
+ -C "ssl_hanshake() returned" \
-C "error" \
-c "HTTP/1.0 200 [Oo][Kk]"
-run_test "Renegotiation: gnutls server, client-initiated" \
- "$G_SRV" \
+run_test "Renegotiation: gnutls server strict, client-initiated" \
+ "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
"$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
0 \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate" \
- -C "ssl_handshake returned" \
+ -C "ssl_hanshake() returned" \
-C "error" \
-c "HTTP/1.0 200 [Oo][Kk]"
+run_test "Renegotiation: gnutls server unsafe, client-initiated default" \
+ "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
+ 1 \
+ -c "client hello, adding renegotiation extension" \
+ -C "found renegotiation extension" \
+ -c "=> renegotiate" \
+ -c "ssl_handshake() returned" \
+ -c "error" \
+ -C "HTTP/1.0 200 [Oo][Kk]"
+
+run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \
+ "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
+ allow_legacy=0" \
+ 1 \
+ -c "client hello, adding renegotiation extension" \
+ -C "found renegotiation extension" \
+ -c "=> renegotiate" \
+ -c "ssl_handshake() returned" \
+ -c "error" \
+ -C "HTTP/1.0 200 [Oo][Kk]"
+
+run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \
+ "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
+ allow_legacy=1" \
+ 0 \
+ -c "client hello, adding renegotiation extension" \
+ -C "found renegotiation extension" \
+ -c "=> renegotiate" \
+ -C "ssl_hanshake() returned" \
+ -C "error" \
+ -c "HTTP/1.0 200 [Oo][Kk]"
+
+# Test for the "secure renegotation" extension only (no actual renegotiation)
+
+run_test "Renego ext: gnutls server strict, client default" \
+ "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3" \
+ 0 \
+ -c "found renegotiation extension" \
+ -C "error" \
+ -c "HTTP/1.0 200 [Oo][Kk]"
+
+run_test "Renego ext: gnutls server unsafe, client default" \
+ "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3" \
+ 0 \
+ -C "found renegotiation extension" \
+ -C "error" \
+ -c "HTTP/1.0 200 [Oo][Kk]"
+
+run_test "Renego ext: gnutls server unsafe, client break legacy" \
+ "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ "$P_CLI debug_level=3 allow_legacy=-1" \
+ 1 \
+ -C "found renegotiation extension" \
+ -c "error" \
+ -C "HTTP/1.0 200 [Oo][Kk]"
+
+run_test "Renego ext: gnutls client strict, server default" \
+ "$P_SRV debug_level=3" \
+ "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \
+ 0 \
+ -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
+ -s "server hello, secure renegotiation extension"
+
+run_test "Renego ext: gnutls client unsafe, server default" \
+ "$P_SRV debug_level=3" \
+ "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ 0 \
+ -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
+ -S "server hello, secure renegotiation extension"
+
+run_test "Renego ext: gnutls client unsafe, server break legacy" \
+ "$P_SRV debug_level=3 allow_legacy=-1" \
+ "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
+ 1 \
+ -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
+ -S "server hello, secure renegotiation extension"
+
# Tests for auth_mode
run_test "Authentication: server badcert, client required" \