added check for servers that disallow the SSL 3.0 record version

diff --git a/src/cli-debug.c b/src/cli-debug.c
index 44b7c100288d0d394ff60c5e9c8b64dae17a9c70..d811870703d647072e38ba4f2158e8196940579d 100644 (file)
--- a/src/cli-debug.c
+++ b/src/cli-debug.c
@@ -85,6 +85,7 @@ static const TLS_TEST tls_tests[] = {
        {"whether \%COMPAT is required", test_record_padding, "no", "yes",
         "dunno"},
        {"for TLS 1.0 (RFC2246) support", test_tls1, "yes", "no", "dunno"},
+       {"for TLS 1.0 (RFC2246) support with TLS 1.0 record version", test_tls1_nossl3, "yes", "no", "dunno"},
        {"for TLS 1.1 (RFC4346) support", test_tls1_1, "yes", "no", "dunno"},
        {"fallback from TLS 1.1 to", test_tls1_1_fallback, "TLS 1.0",
         "failed",

diff --git a/src/tests.c b/src/tests.c
index 4b11c48c642cb58c992adc964be48e1d2fd9e195..bc654a08f4b3ce1bed873838a9a37ec8a935d4f2 100644 (file)
--- a/src/tests.c
+++ b/src/tests.c
@@ -664,7 +664,7 @@ test_code_t test_tls1(gnutls_session_t session)
 
        sprintf(prio_str,
                INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
-               ":+VERS-TLS1.0:" ALL_MACS ":" ALL_KX ":%s", rest);
+               ":+VERS-TLS1.0:%%SSL3_RECORD_VERSION:" ALL_MACS ":" ALL_KX ":%s", rest);
        _gnutls_priority_set_direct(session, prio_str);
 
        gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
@@ -677,6 +677,30 @@ test_code_t test_tls1(gnutls_session_t session)
 
 }
 
+test_code_t test_tls1_nossl3(gnutls_session_t session)
+{
+       int ret;
+
+       if (tls1_ok != 0)
+               return TEST_IGNORE;
+
+       sprintf(prio_str,
+               INIT_STR ALL_CIPHERS ":" ALL_COMP ":" ALL_CERTTYPES
+               ":+VERS-TLS1.0:%%LATEST_RECORD_VERSION:" ALL_MACS ":" ALL_KX ":%s", rest);
+       _gnutls_priority_set_direct(session, prio_str);
+
+       gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+       ret = do_handshake(session);
+       if (ret == TEST_SUCCEED) {
+               strcat(rest, ":%LATEST_RECORD_VERSION");
+               tls1_ok = 1;
+       }
+
+       return ret;
+
+}
+
 test_code_t test_record_padding(gnutls_session_t session)
 {
        int ret;

diff --git a/src/tests.h b/src/tests.h
index 34dd7d7c7ccfc0e4aa16a66c153ee7731c2d4b72..63c60a54c699df2b961793ea53af733ce6765872 100644 (file)
--- a/src/tests.h
+++ b/src/tests.h
@@ -38,6 +38,7 @@ test_code_t test_sha(gnutls_session_t state);
 test_code_t test_3des(gnutls_session_t state);
 test_code_t test_arcfour(gnutls_session_t state);
 test_code_t test_tls1(gnutls_session_t state);
+test_code_t test_tls1_nossl3(gnutls_session_t session);
 test_code_t test_safe_renegotiation(gnutls_session_t state);
 test_code_t test_ext_master_secret(gnutls_session_t state);
 test_code_t test_etm(gnutls_session_t state);