mirrors/libmicrohttpd
2
0
Fork 0
mirror of https://git.gnunet.org/libmicrohttpd.git synced 2026-09-28 04:09:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

getting gnutls tests to pass:

Browse Source
This commit is contained in:
Christian Grothoff
2010-07-25 09:47:50 +00:00
parent 67851b280e
commit 63b5f01682
11 changed files with 141 additions and 266 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+4
View File
@@ -1,3 +1,7 @@
Sun Jul 25 11:10:45 CEST 2010
Changed code to use external libgnutls code instead of
the "fork". Minor API changes for setting TLS options. -CG
Sun Jun 13 10:52:34 CEST 2010
Cleaned up example code. -CG
configure.ac
+34 -6
View File
@@ -233,7 +233,39 @@ AM_PATH_LIBGCRYPT(1.2.2, gcrypt=true)
MHD_GCRYPT_VERSION=1:1.2.2
AC_DEFINE_UNQUOTED([MHD_GCRYPT_VERSION], "$MHD_GCRYPT_VERSION", [gcrypt lib version])
AM_PATH_LIBGNUTLS(2.8.6, gnutls=true)
# gnutls
gnutls=0
AC_MSG_CHECKING([for gnutls])
AC_ARG_WITH(gnutls,
[ --with-gnutls=PFX base of gnutls installation],
[AC_MSG_RESULT([$with_gnutls])
case $with_gnutls in
no)
;;
yes)
AC_CHECK_HEADERS([gnutls/gnutls.h],
AC_CHECK_LIB([gnutls], [gnutls_priority_set],
gnutls=true))
;;
*)
LDFLAGS="-L$with_gnutls/lib $LDFLAGS"
CPPFLAGS="-I$with_gnutls/include $CPPFLAGS"
AC_CHECK_HEADERS([gnutls/gnutls.h],
AC_CHECK_LIB([gnutls], [gnutls_priority_set],
EXT_LIB_PATH="-L$with_gnutls/lib $EXT_LIB_PATH"
gnutls=true))
;;
esac
],
[AC_MSG_RESULT([--with-gnutls not specified])
AC_CHECK_HEADERS([gnutls/gnutls.h],
AC_CHECK_LIB([gnutls], [gnutls_priority_set],
gnutls=true))])
AM_CONDITIONAL(HAVE_GNUTLS, test x$gnutls = xtrue)
AC_DEFINE_UNQUOTED([HAVE_GNUTLS], $gnutls, [We have gnutls])
# optional: HTTPS support. Enabled by default
AC_MSG_CHECKING(whether to enable HTTPS support)
@@ -261,7 +293,7 @@ AM_CONDITIONAL(ENABLE_HTTPS, test "$enable_https" = "yes")
MHD_LIB_LDFLAGS="-export-dynamic -no-undefined"
dnl TODO insert a proper check here
# TODO insert a proper check here
AC_CACHE_CHECK([whether -export-symbols-regex works],
gn_cv_export_symbols_regex_works,
[
@@ -272,10 +304,6 @@ AC_CACHE_CHECK([whether -export-symbols-regex works],
])
# Symbols required by GNU_TLS
AC_DEFINE([GNULIB_GC_RANDOM],[1],[GNULIB_GC_RANDOM])
# gcov compilation
use_gcov=no
AC_ARG_ENABLE([coverage],
doc/microhttpd.texi
+8 -13
View File
@@ -11,7 +11,7 @@ header file @file{microhttpd.h}.
@noindent
Copyright @copyright{} 2007, 2008, 2009 Christian Grothoff
Copyright @copyright{} 2007, 2008, 2009, 2010 Christian Grothoff
@quotation
Permission is granted to copy, distribute and/or modify this document
@@ -358,18 +358,13 @@ Daemon credentials type. Either certificate or anonymous,
this option should be followed by one of the values listed in
"enum MHD_GNUTLS_CredentialsType".
@item MHD_OPTION_PROTOCOL_VERSION
SSL/TLS protocol version.
Memory pointer to a zero (MHD_GNUTLS_PROTOCOL_END) terminated
(const) array of 'enum MHD_GNUTLS_Protocol' values representing the
protocol versions to this server should support. Unsupported
requests will be dropped by the server.
@item MHD_OPTION_CIPHER_ALGORITHM
Memory pointer to a zero (MHD_GNUTLS_CIPHER_UNKNOWN)
terminated (const) array of 'enum MHD_GNUTLS_CipherAlgorithm'
representing the cipher priority order to which the HTTPS
daemon should adhere.
@item MHD_OPTION_HTTPS_PRIORITIES
SSL/TLS protocol version and ciphers.
This option must be followwed by an "const char *" argument
specifying the SSL/TLS protocol versions and ciphers that
are acceptable for the application. The string is passed
unchanged to gnutls_priority_init. If this option is not
specified, ``NORMAL'' is used.
@item MHD_OPTION_EXTERNAL_LOGGER
@cindex logging
m4/libgnutls.m4
-160
View File
@@ -1,160 +0,0 @@
dnl Autoconf macros for libgnutls
dnl $id$
# Modified for LIBGNUTLS -- nmav
# Configure paths for LIBGCRYPT
# Shamelessly stolen from the one of XDELTA by Owen Taylor
# Werner Koch 99-12-09
dnl AM_PATH_LIBGNUTLS([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]])
dnl Test for libgnutls, and define LIBGNUTLS_CFLAGS and LIBGNUTLS_LIBS
dnl
AC_DEFUN([AM_PATH_LIBGNUTLS],
[dnl
dnl Get the cflags and libraries from the libgnutls-config script
dnl
AC_ARG_WITH(libgnutls-prefix,
[ --with-libgnutls-prefix=PFX Prefix where libgnutls is installed (optional)],
libgnutls_config_prefix="$withval", libgnutls_config_prefix="")
if test x$libgnutls_config_prefix != x ; then
if test x${LIBGNUTLS_CONFIG+set} != xset ; then
LIBGNUTLS_CONFIG=$libgnutls_config_prefix/bin/libgnutls-config
fi
fi
AC_PATH_PROG(LIBGNUTLS_CONFIG, libgnutls-config, no)
min_libgnutls_version=ifelse([$1], ,0.1.0,$1)
AC_MSG_CHECKING(for libgnutls - version >= $min_libgnutls_version)
no_libgnutls=""
if test "$LIBGNUTLS_CONFIG" = "no" ; then
no_libgnutls=yes
else
LIBGNUTLS_CFLAGS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --cflags`
LIBGNUTLS_LIBS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --libs`
libgnutls_config_version=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
ac_save_CFLAGS="$CFLAGS"
ac_save_LIBS="$LIBS"
CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
LIBS="$LIBS $LIBGNUTLS_LIBS"
dnl
dnl Now check if the installed libgnutls is sufficiently new. Also sanity
dnl checks the results of libgnutls-config to some extent
dnl
rm -f conf.libgnutlstest
AC_TRY_RUN([
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls/gnutls.h>
int
main ()
{
system ("touch conf.libgnutlstest");
if( strcmp( gnutls_check_version(NULL), "$libgnutls_config_version" ) )
{
printf("\n*** 'libgnutls-config --version' returned %s, but LIBGNUTLS (%s)\n",
"$libgnutls_config_version", gnutls_check_version(NULL) );
printf("*** was found! If libgnutls-config was correct, then it is best\n");
printf("*** to remove the old version of LIBGNUTLS. You may also be able to fix the error\n");
printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n");
printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n");
printf("*** required on your system.\n");
printf("*** If libgnutls-config was wrong, set the environment variable LIBGNUTLS_CONFIG\n");
printf("*** to point to the correct copy of libgnutls-config, and remove the file config.cache\n");
printf("*** before re-running configure\n");
}
else if ( strcmp(gnutls_check_version(NULL), LIBGNUTLS_VERSION ) )
{
printf("\n*** LIBGNUTLS header file (version %s) does not match\n", LIBGNUTLS_VERSION);
printf("*** library (version %s)\n", gnutls_check_version(NULL) );
}
else
{
if ( gnutls_check_version( "$min_libgnutls_version" ) )
{
return 0;
}
else
{
printf("no\n*** An old version of LIBGNUTLS (%s) was found.\n",
gnutls_check_version(NULL) );
printf("*** You need a version of LIBGNUTLS newer than %s. The latest version of\n",
"$min_libgnutls_version" );
printf("*** LIBGNUTLS is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
printf("*** \n");
printf("*** If you have already installed a sufficiently new version, this error\n");
printf("*** probably means that the wrong copy of the libgnutls-config shell script is\n");
printf("*** being found. The easiest way to fix this is to remove the old version\n");
printf("*** of LIBGNUTLS, but you can also set the LIBGNUTLS_CONFIG environment to point to the\n");
printf("*** correct copy of libgnutls-config. (In this case, you will have to\n");
printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n");
printf("*** so that the correct libraries are found at run-time))\n");
}
}
return 1;
}
],, no_libgnutls=yes,[echo $ac_n "cross compiling; assumed OK... $ac_c"])
CFLAGS="$ac_save_CFLAGS"
LIBS="$ac_save_LIBS"
fi
if test "x$no_libgnutls" = x ; then
AC_MSG_RESULT(yes)
ifelse([$2], , :, [$2])
else
if test -f conf.libgnutlstest ; then
:
else
AC_MSG_RESULT(no)
fi
if test "$LIBGNUTLS_CONFIG" = "no" ; then
echo "*** The libgnutls-config script installed by LIBGNUTLS could not be found"
echo "*** If LIBGNUTLS was installed in PREFIX, make sure PREFIX/bin is in"
echo "*** your path, or set the LIBGNUTLS_CONFIG environment variable to the"
echo "*** full path to libgnutls-config."
else
if test -f conf.libgnutlstest ; then
:
else
echo "*** Could not run libgnutls test program, checking why..."
CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
LIBS="$LIBS $LIBGNUTLS_LIBS"
AC_TRY_LINK([
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls.h>
], [ return !!gnutls_check_version(NULL); ],
[ echo "*** The test program compiled, but did not run. This usually means"
echo "*** that the run-time linker is not finding LIBGNUTLS or finding the wrong"
echo "*** version of LIBGNUTLS. If it is not finding LIBGNUTLS, you'll need to set your"
echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point"
echo "*** to the installed location Also, make sure you have run ldconfig if that"
echo "*** is required on your system"
echo "***"
echo "*** If you have an old version installed, it is best to remove it, although"
echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH"
echo "***" ],
[ echo "*** The test program failed to compile or link. See the file config.log for the"
echo "*** exact error that occured. This usually means LIBGNUTLS was incorrectly installed"
echo "*** or that you have moved LIBGNUTLS since it was installed. In the latter case, you"
echo "*** may want to edit the libgnutls-config script: $LIBGNUTLS_CONFIG" ])
CFLAGS="$ac_save_CFLAGS"
LIBS="$ac_save_LIBS"
fi
fi
LIBGNUTLS_CFLAGS=""
LIBGNUTLS_LIBS=""
ifelse([$3], , :, [$3])
fi
rm -f conf.libgnutlstest
AC_SUBST(LIBGNUTLS_CFLAGS)
AC_SUBST(LIBGNUTLS_LIBS)
])
dnl *-*wedit:notab*-* Please keep this as the last line.
src/daemon/Makefile.am
+2 -4
View File
@@ -1,8 +1,7 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/include \
-I$(top_srcdir)/src/daemon \
@LIBGCRYPT_CFLAGS@ \
@LIBGNUTLS_CFLAGS@
@LIBGCRYPT_CFLAGS@
EXTRA_DIST = EXPORT.sym
@@ -29,8 +28,7 @@ endif
if ENABLE_HTTPS
libmicrohttpd_la_SOURCES += \
connection_https.c connection_https.h
libmicrohttpd_la_LIBADD = \
$(LIBGNUTLS_LIBS)
libmicrohttpd_la_LIBADD = -lgnutls
endif
check_PROGRAMS = \
src/daemon/daemon.c
+16 -5
View File
@@ -33,6 +33,7 @@
#if HTTPS_SUPPORT
#include "connection_https.h"
#include <gnutls/gnutls.h>
#include <gcrypt.h>
#endif
#ifdef HAVE_POLL_H
@@ -1245,6 +1246,7 @@ parse_options_va (struct MHD_Daemon *daemon,
unsigned int i;
#if HTTPS_SUPPORT
int ret;
const char *pstr;
#endif
while (MHD_OPTION_END != (opt = va_arg (ap, enum MHD_OPTION)))
@@ -1308,14 +1310,18 @@ parse_options_va (struct MHD_Daemon *daemon,
opt);
#endif
break;
case MHD_OPTION_CIPHER_ALGORITHM:
case MHD_OPTION_CRED_TYPE:
daemon->cred_type = va_arg (ap, gnutls_credentials_type_t);
break;
case MHD_OPTION_HTTPS_PRIORITIES:
ret = gnutls_priority_init (&daemon->priority_cache,
va_arg (ap, const char*),
pstr = va_arg (ap, const char*),
NULL);
#if HAVE_MESSAGES
if (ret != GNUTLS_E_SUCCESS)
FPRINTF (stderr,
"gnutls unhappy: %s\n",
"Setting priorities to `%s' failed: %s\n",
pstr,
gnutls_strerror (ret));
#endif
if (ret != GNUTLS_E_SUCCESS)
@@ -1373,7 +1379,7 @@ parse_options_va (struct MHD_Daemon *daemon,
case MHD_OPTION_SOCK_ADDR:
case MHD_OPTION_HTTPS_MEM_KEY:
case MHD_OPTION_HTTPS_MEM_CERT:
case MHD_OPTION_CIPHER_ALGORITHM:
case MHD_OPTION_HTTPS_PRIORITIES:
case MHD_OPTION_ARRAY:
if (MHD_YES != parse_options (daemon,
servaddr,
@@ -1404,7 +1410,7 @@ parse_options_va (struct MHD_Daemon *daemon,
default:
#if HAVE_MESSAGES
if ((opt >= MHD_OPTION_HTTPS_MEM_KEY) &&
(opt <= MHD_OPTION_CIPHER_ALGORITHM))
(opt <= MHD_OPTION_HTTPS_PRIORITIES))
{
FPRINTF (stderr,
"MHD HTTPS option %d passed to MHD compiled without HTTPS support\n",
@@ -1989,6 +1995,10 @@ sigalrmHandler (int sig)
#define ATTRIBUTE_DESTRUCTOR
#endif // __GNUC__
#if HTTPS_SUPPORT
GCRY_THREAD_OPTION_PTHREAD_IMPL;
#endif
/**
* Initialize the signal handler for SIGALRM
* and do other setup work.
@@ -2009,6 +2019,7 @@ void ATTRIBUTE_CONSTRUCTOR MHD_init ()
plibc_init ("GNU", "libmicrohttpd");
#endif
#if HTTPS_SUPPORT
gcry_control (GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
gnutls_global_init ();
if (0 != pthread_mutex_init(&MHD_gnutls_init_mutex, NULL))
abort();
src/include/microhttpd.h
+1 -1
View File
@@ -421,7 +421,7 @@ enum MHD_OPTION
* Memory pointer to a "const char*" specifying the
* cipher algorithm (default: "NORMAL").
*/
MHD_OPTION_CIPHER_ALGORITHM = 12,
MHD_OPTION_HTTPS_PRIORITIES = 12,
/**
* Use the given function for logging error messages.
src/testcurl/https/mhds_get_test.c
+4 -14
View File
@@ -43,14 +43,13 @@ test_cipher_option (FILE * test_fd, char *cipher_suite, int proto_version)
{
int ret;
int ciper[] = { GNUTLS_CIPHER_3DES_CBC, 0 };
struct MHD_Daemon *d;
d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
MHD_USE_DEBUG, 42433,
NULL, NULL, &http_ahc, NULL,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_CIPHER_ALGORITHM, ciper, MHD_OPTION_END);
MHD_OPTION_END);
if (d == NULL)
{
@@ -90,37 +89,28 @@ test_secure_get (FILE * test_fd, char *cipher_suite, int proto_version)
return ret;
}
GCRY_THREAD_OPTION_PTHREAD_IMPL;
int
main (int argc, char *const *argv)
{
FILE *test_fd;
unsigned int errorCount = 0;
/* gnutls_global_set_log_level(11); */
if (curl_check_version (MHD_REQ_CURL_VERSION, MHD_REQ_CURL_OPENSSL_VERSION))
{
return -1;
}
gcry_control (GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
gnutls_global_set_log_level(11);
if (curl_check_version (MHD_REQ_CURL_VERSION, MHD_REQ_CURL_GNUTLS_VERSION))
return -1;
if (!gcry_check_version (GCRYPT_VERSION))
abort ();
if ((test_fd = setup_test_file ()) == NULL)
{
fprintf (stderr, MHD_E_TEST_FILE_CREAT);
return -1;
}
if (0 != curl_global_init (CURL_GLOBAL_ALL))
{
fprintf (stderr, "Error: %s\n", strerror (errno));
fclose (test_fd);
return -1;
}
errorCount +=
test_secure_get (test_fd, "AES256-SHA", CURL_SSLVERSION_TLSv1);
errorCount +=
src/testcurl/https/mhds_get_test_select.c
-2
View File
@@ -59,14 +59,12 @@ ahc_echo (void *cls,
if (&ptr != *unused)
{
*unused = &ptr;
fprintf (stderr, "received %s\n", method);
return MHD_YES;
}
*unused = NULL;
response = MHD_create_response_from_data (strlen (url),
(void *) url, MHD_NO, MHD_YES);
ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
fprintf (stderr, "sending reply\n");
MHD_destroy_response (response);
if (ret == MHD_NO)
abort ();
src/testcurl/https/mhds_session_info_test.c
+24 -13
View File
@@ -48,24 +48,33 @@ query_session_ahc (void *cls, struct MHD_Connection *connection,
{
struct MHD_Response *response;
int ret;
if (NULL == *ptr)
{
*ptr = &query_session_ahc;
return MHD_YES;
}
/* assert actual connection cipher is the one negotiated */
if (MHD_get_connection_info
(connection,
MHD_CONNECTION_INFO_CIPHER_ALGO)->cipher_algorithm !=
GNUTLS_CIPHER_AES_256_CBC)
if (GNUTLS_CIPHER_AES_256_CBC !=
(ret = MHD_get_connection_info
(connection,
MHD_CONNECTION_INFO_CIPHER_ALGO)->cipher_algorithm))
{
fprintf (stderr, "Error: requested cipher mismatch. %s\n",
strerror (errno));
fprintf (stderr, "Error: requested cipher mismatch (wanted %d, got %d)\n",
GNUTLS_CIPHER_AES_256_CBC,
ret);
return -1;
}
if (MHD_get_connection_info
(connection,
MHD_CONNECTION_INFO_PROTOCOL)->protocol != GNUTLS_SSL3)
if (GNUTLS_SSL3 !=
(ret = MHD_get_connection_info
(connection,
MHD_CONNECTION_INFO_PROTOCOL)->protocol))
{
fprintf (stderr, "Error: requested compression mismatch. %s\n",
strerror (errno));
fprintf (stderr, "Error: requested protocol mismatch (wanted %d, got %d)\n",
GNUTLS_SSL3,
ret);
return -1;
}
@@ -99,6 +108,7 @@ test_query_session ()
d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
MHD_USE_DEBUG, DEAMON_TEST_PORT,
NULL, NULL, &query_session_ahc, NULL,
MHD_OPTION_HTTPS_PRIORITIES, "NORMAL:-AES-128-CBC",
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_END);
@@ -167,6 +177,7 @@ main (int argc, char *const *argv)
print_test_result (errorCount, argv[0]);
curl_global_cleanup ();
return errorCount != 0;
if (errorCount > 0)
fprintf (stderr, "Error (code: %u)\n", errorCount);
return errorCount;
}
src/testcurl/https/tls_daemon_options_test.c
+48 -48
View File
@@ -28,6 +28,7 @@
#include "microhttpd.h"
#include <sys/stat.h>
#include <limits.h>
#include <gcrypt.h>
#include "tls_test_common.h"
extern const char srv_key_pem[];
@@ -40,7 +41,7 @@ int curl_check_version (const char *req_version, ...);
*
*/
/* TODO rm test_fd */
static int
int
test_unmatching_ssl_version (FILE * test_fd, char *cipher_suite,
int curl_req_ssl_version)
{
@@ -79,12 +80,11 @@ main (int argc, char *const *argv)
{
FILE *test_fd;
unsigned int errorCount = 0;
unsigned int cpos;
char test_name[64];
int daemon_flags =
MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL | MHD_USE_DEBUG;
gcry_control (GCRYCTL_DISABLE_SECMEM, 0);
gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
if (curl_check_version (MHD_REQ_CURL_VERSION))
{
return -1;
@@ -103,46 +103,39 @@ main (int argc, char *const *argv)
fprintf (stderr, "Error: %s\n", strerror (errno));
return -1;
}
#if 0
errorCount +=
test_wrap ("TLS1.0-AES-SHA1",
&test_https_transfer, test_fd, daemon_flags,
"AES128-SHA1",
CURL_SSLVERSION_TLSv1,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_HTTPS_PRIORITIES, "NONE:+VERS-TLS1.0:+AES-128-CBC:+SHA1:+RSA:+COMP-NULL",
MHD_OPTION_END);
#endif
#if 0
errorCount +=
test_wrap ("TLS1.0-AES-SHA1",
&test_https_transfer, test_fd, daemon_flags,
"AES128-SHA1",
CURL_SSLVERSION_SSLv3,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_HTTPS_PRIORITIES, "NONE:+VERS-SSL3.0:+AES-128-CBC:+SHA1:+RSA:+COMP-NULL",
MHD_OPTION_END);
errorCount +=
test_wrap ("SSL3.0-AES-SHA1",
&test_https_transfer, test_fd, daemon_flags,
"AES128-SHA1",
CURL_SSLVERSION_SSLv3,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_HTTPS_PRIORITIES, "NONE:+VERS-SSL3.0:+AES-128-CBC:+SHA1:+RSA:+COMP-NULL",
MHD_OPTION_END);
#endif
struct CipherDef ciphers[] = {
{{GNUTLS_CIPHER_AES_128_CBC, 0}, "AES128-SHA"},
{{GNUTLS_CIPHER_ARCFOUR_128, 0}, "RC4-SHA"},
{{GNUTLS_CIPHER_3DES_CBC, 0}, "3DES-SHA"},
{{GNUTLS_CIPHER_AES_256_CBC, 0}, "AES256-SHA"},
{{0, 0}, NULL}
};
fprintf (stderr, "SHA/TLS tests:\n");
cpos = 0;
while (ciphers[cpos].curlname != NULL)
{
sprintf (test_name, "%s-TLS", ciphers[cpos].curlname);
errorCount +=
test_wrap (test_name,
&test_https_transfer, test_fd, daemon_flags,
ciphers[cpos].curlname,
CURL_SSLVERSION_TLSv1,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_CIPHER_ALGORITHM, "NORMAL",
MHD_OPTION_END);
cpos++;
}
fprintf (stderr, "SHA/SSL3 tests:\n");
cpos = 0;
while (ciphers[cpos].curlname != NULL)
{
sprintf (test_name, "%s-SSL3", ciphers[cpos].curlname);
errorCount +=
test_wrap (test_name,
&test_https_transfer, test_fd, daemon_flags,
ciphers[cpos].curlname,
CURL_SSLVERSION_SSLv3,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_CIPHER_ALGORITHM, "NORMAL",
MHD_OPTION_END);
cpos++;
}
#if 0
/* manual inspection of the handshake suggests that CURL will
request TLSv1, we send back "SSL3" and CURL takes it *despite*
@@ -158,12 +151,19 @@ main (int argc, char *const *argv)
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_CIPHER_ALGORITHM, "SSL3", MHD_OPTION_END);
#endif
#if 1
errorCount +=
test_wrap ("unmatching version: TLS vs. SSL3", &test_unmatching_ssl_version,
test_fd, daemon_flags, "AES256-SHA", CURL_SSLVERSION_SSLv3,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_CIPHER_ALGORITHM, "SSL3", MHD_OPTION_END);
test_wrap ("TLS1.0 vs SSL3",
&test_unmatching_ssl_version, test_fd, daemon_flags,
"AES256-SHA",
CURL_SSLVERSION_SSLv3,
MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
MHD_OPTION_HTTPS_PRIORITIES, "NONE:+VERS-TLS1.0:+AES-256-CBC:+SHA1:+RSA:+COMP-NULL",
MHD_OPTION_END);
#endif
curl_global_cleanup ();
fclose (test_fd);
remove (TEST_FILE_NAME);