*** empty log message ***

diff --git a/src/tests.c b/src/tests.c
index 9f62fa3f5a54bbdc99a9c563aacc4e9746888197..220094a87b9a14ab9130517ca30aca935d4669c3 100644 (file)
--- a/src/tests.c
+++ b/src/tests.c
@@ -44,8 +44,9 @@ extern gnutls_certificate_credentials xcred;
 extern int more_info;
 static int dh_bits;
 
-extern int tls1_ok;
-extern int ssl3_ok;
+int tls1_ok = 0;
+int ssl3_ok = 0;
+int tls1_1_ok = 0;
 
 /* keep session info */
 static char *session_data = NULL;
@@ -86,7 +87,10 @@ int ret, alert;
                }
                session_data = malloc(session_data_size);
                sfree = 1;
-               if (session_data==NULL) exit(1);
+               if (session_data==NULL) {
+                       fprintf(stderr, "Memory error\n");
+                       exit(1);
+               }
                gnutls_session_get_data(session, session_data, &session_data_size);
 
                session_id_size = sizeof( session_id);
@@ -164,13 +168,24 @@ static void ADD_CERTTYPE(gnutls_session session, int ctype) {
        gnutls_certificate_type_set_priority(session, _ct_priority);
 }
 
-static void ADD_PROTOCOL(gnutls_session session, int protocol) {
+static void ADD_PROTOCOL(gnutls_session session, int protocol) 
+{
        static int _proto_priority[] = { 0, 0 };
        _proto_priority[0] = protocol;
 
        gnutls_protocol_set_priority(session, _proto_priority);
 }
 
+static void ADD_PROTOCOL3(gnutls_session session, int p1, int p2, int p3)
+{
+       static int _proto_priority[] = { 0, 0, 0, 0 };
+       _proto_priority[0] = p1;
+       _proto_priority[1] = p2;
+       _proto_priority[2] = p3;
+
+       gnutls_protocol_set_priority(session, _proto_priority);
+}
+
 #ifdef ENABLE_SRP
 static int srp_detected;
 
@@ -245,7 +260,8 @@ int test_dhe_bits( gnutls_session session) {
        return SUCCEED;
 }
 
-int test_ssl3( gnutls_session session) {
+int test_ssl3( gnutls_session session) 
+{
 int ret;
        ADD_ALL_CIPHERS(session);
        ADD_ALL_COMP(session);
@@ -260,8 +276,10 @@ int ret;
        
        return ret;
 }
+
 static int alrm=0;
-void got_alarm(int k) {
+void got_alarm(int k) 
+{
        alrm = 1;
 }
        
@@ -483,7 +501,8 @@ int ret;
        return ret;
 }
 
-int test_tls1( gnutls_session session) {
+int test_tls1( gnutls_session session) 
+{
 int ret;
        ADD_ALL_CIPHERS(session);
        ADD_ALL_COMP(session);
@@ -500,7 +519,8 @@ int ret;
 
 }
 
-int test_tls1_1( gnutls_session session) {
+int test_tls1_1( gnutls_session session) 
+{
 int ret;
        ADD_ALL_CIPHERS(session);
        ADD_ALL_COMP(session);
@@ -511,12 +531,37 @@ int ret;
        gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
 
        ret = do_handshake( session);
-       if (ret==SUCCEED) tls1_ok = 1;
+       if (ret==SUCCEED) tls1_1_ok = 1;
 
        return ret;
 
 }
 
+int test_tls1_1_fallback( gnutls_session session) 
+{
+int ret;
+       ADD_ALL_CIPHERS(session);
+       ADD_ALL_COMP(session);
+       ADD_ALL_CERTTYPES(session);
+       ADD_PROTOCOL3(session, GNUTLS_TLS1_1, GNUTLS_TLS1, GNUTLS_SSL3);
+       ADD_ALL_MACS(session);
+       ADD_ALL_KX(session);
+       gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+       if (tls1_1_ok) return UNSURE;
+
+       ret = do_handshake( session);
+       if (ret!=SUCCEED) return GFAILED;
+
+       if (gnutls_protocol_get_version( session)==GNUTLS_TLS1)
+               return SUCCEED;
+       else if (gnutls_protocol_get_version( session)==GNUTLS_SSL3)
+               return UNSURE;
+
+       return GFAILED;
+
+}
+
 /* Advertize both TLS 1.0 and SSL 3.0. If the connection fails,
  * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
  */

diff --git a/src/tests.h b/src/tests.h
index 2ed83cd8d78614c46fd0119fbe280d5cca1d8b6c..6a4125a9a3fdadc7c8d5c6bc07f86d46bdda1495 100644 (file)
--- a/src/tests.h
+++ b/src/tests.h
@@ -17,6 +17,7 @@ int test_arcfour( gnutls_session state);
 int test_arcfour_40( gnutls_session state);
 int test_tls1( gnutls_session state);
 int test_tls1_1( gnutls_session state);
+int test_tls1_1_fallback( gnutls_session state);
 int test_tls_disable( gnutls_session state);
 int test_rsa_pms( gnutls_session state);
 int test_max_record_size( gnutls_session state);

diff --git a/src/tls_test.c b/src/tls_test.c
index e7c1c6a825adeaadc37a10a94b847eaf5e289746..0ace0f064c4be5e8fabff2b2d62382a0c45bbb71 100644 (file)
--- a/src/tls_test.c
+++ b/src/tls_test.c
@@ -61,8 +61,9 @@ gnutls_certificate_credentials xcred;
 
 int more_info = 0;
 
-int tls1_ok = 0;
-int ssl3_ok = 0;
+extern int tls1_ok;
+extern int tls1_1_ok;
+extern int ssl3_ok;
 
 static void tls_log_func( int level, const char* str)
 {
@@ -81,6 +82,7 @@ typedef struct {
 
 static const TLS_TEST tls_tests[] = {
        { "for TLS 1.1 support", test_tls1_1, "yes", "no", "dunno" },
+       { "fallback from TLS 1.1 to", test_tls1_1_fallback, "TLS 1.0", "", "SSL 3.0" },
        { "for TLS 1.0 support", test_tls1, "yes", "no", "dunno" },
        { "for SSL 3.0 support", test_ssl3, "yes", "no", "dunno" },
        { "for version rollback bug in RSA PMS", test_rsa_pms, "no", "yes", "dunno" },
@@ -151,8 +153,6 @@ int main(int argc, char **argv)
        gnutls_session state;
        char buffer[MAX_BUF + 1];
        struct hostent *server_host;
-       int ssl3_ok = 0;
-       int tls1_ok = 0;
 
        gaa_parser(argc, argv);
 
@@ -215,7 +215,10 @@ int main(int argc, char **argv)
 
                /* if neither of SSL3 and TLSv1 are supported, exit
                 */
-               if (i > 1 && tls1_ok == 0 && ssl3_ok == 0) break;
+               if (i > 3 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0) {
+                       fprintf(stderr, "%d %d %d\n", tls1_1_ok,tls1_ok,ssl3_ok);
+                       break;
+               }
 
                CONNECT();
                gnutls_init(&state, GNUTLS_CLIENT);