Adding upstream version 3.7.9.upstream/3.7.9upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1770 insertions, 0 deletions

diff --git a/src/tests.c b/src/tests.c
new file mode 100644
index 0000000..85c4b66
--- /dev/null
+++ b/src/tests.c
@@ -0,0 +1,1770 @@
+/*
+ * Copyright (C) 2000-2012 Free Software Foundation, Inc.
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see
+ * <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+
+#ifndef _WIN32
+#include <unistd.h>
+#include <signal.h>
+#else
+#include <errno.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <common.h>
+#include <tests.h>
+
+void _gnutls_record_set_default_version(gnutls_session_t session,
+					unsigned char major,
+					unsigned char minor);
+
+void _gnutls_hello_set_default_version(gnutls_session_t session,
+					unsigned char major,
+					unsigned char minor);
+
+
+extern gnutls_srp_client_credentials_t srp_cred;
+extern gnutls_anon_client_credentials_t anon_cred;
+extern gnutls_certificate_credentials_t xcred;
+
+extern unsigned int verbose;
+
+const char *ext_text = "";
+static int tls_ext_ok = 1;
+static int tls1_ok = 0;
+static int ssl3_ok = 0;
+static int tls1_1_ok = 0;
+static int tls1_2_ok = 0;
+static int tls1_3_ok = 0;
+static int send_record_ok = 0;
+
+/* keep session info */
+static char *session_data = NULL;
+static char session_id[32];
+static size_t session_data_size = 0, session_id_size = 0;
+static int sfree = 0;
+static int handshake_output = 0;
+
+static int test_do_handshake(gnutls_session_t session)
+{
+	int ret, alert;
+
+	do {
+		ret = gnutls_handshake(session);
+	}
+	while (ret < 0 && gnutls_error_is_fatal(ret) == 0);
+
+	handshake_output = ret;
+
+	if (ret < 0 && verbose > 1) {
+		if (ret == GNUTLS_E_FATAL_ALERT_RECEIVED) {
+			alert = gnutls_alert_get(session);
+			printf("\n");
+			printf("*** Received alert [%d]: %s\n",
+			       alert, gnutls_alert_get_name(alert));
+		}
+	}
+
+	if (ret < 0)
+		return TEST_FAILED;
+	gnutls_session_get_data(session, NULL, &session_data_size);
+
+	if (sfree != 0) {
+		free(session_data);
+		sfree = 0;
+	}
+	session_data = malloc(session_data_size);
+	sfree = 1;
+	if (session_data == NULL) {
+		fprintf(stderr, "Memory error\n");
+		exit(1);
+	}
+	gnutls_session_get_data(session, session_data, &session_data_size);
+
+	session_id_size = sizeof(session_id);
+	gnutls_session_get_id(session, session_id, &session_id_size);
+
+	return TEST_SUCCEED;
+}
+
+char protocol_str[] =
+    "+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
+char protocol_all_str[] =
+    "+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0";
+char prio_str[768] = "";
+
+#ifdef ENABLE_GOST
+#define GOST_CIPHERS ":+GOST28147-TC26Z-CNT"
+#define GOST_MACS ":+GOST28147-TC26Z-IMIT"
+#define GOST_KX ":+VKO-GOST-12"
+#define GOST_REST ":+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:+GROUP-GOST-ALL"
+#else
+#define GOST_CIPHERS
+#define GOST_MACS
+#define GOST_KX
+#define GOST_REST
+#endif
+
+#define ALL_CIPHERS "+CIPHER-ALL:+ARCFOUR-128:+3DES-CBC" GOST_CIPHERS
+#define BLOCK_CIPHERS "+3DES-CBC:+AES-128-CBC:+CAMELLIA-128-CBC:+AES-256-CBC:+CAMELLIA-256-CBC"
+#define SSL3_CIPHERS "+ARCFOUR-128:+3DES-CBC"
+#define ALL_COMP "+COMP-NULL"
+#define ALL_MACS "+MAC-ALL:+MD5:+SHA1" GOST_MACS
+#define SSL3_MACS "+MD5:+SHA1"
+#define ALL_KX "+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+ECDHE-RSA:+ECDHE-ECDSA:+ANON-ECDH" GOST_KX
+#define SSL3_KX "+RSA:+DHE-RSA:+DHE-DSS"
+#define INIT_STR "NONE:"
+char rest[384] = "%UNSAFE_RENEGOTIATION:+SIGN-ALL:+GROUP-ALL" GOST_REST;
+
+#define _gnutls_priority_set_direct(s, str) { \
+		int _ret; \
+		if ((_ret=__gnutls_priority_set_direct(s, str, __LINE__)) != TEST_SUCCEED) { \
+			return _ret; \
+		} \
+	}
+
+static inline int
+__gnutls_priority_set_direct(gnutls_session_t session, const char *str, int line)
+{
+	const char *err;
+	int ret = gnutls_priority_set_direct(session, str, &err);
+
+	if (ret < 0) {
+		/* this can happen when some cipher is disabled system-wide */
+		if (ret == GNUTLS_E_NO_PRIORITIES_WERE_SET)
+			return TEST_IGNORE;
+
+		fprintf(stderr, "Error at %d with string %s\n", line, str);
+		fprintf(stderr, "Error at %s: %s\n", err,
+			gnutls_strerror(ret));
+		exit(1);
+	}
+
+	return TEST_SUCCEED;
+}
+
+test_code_t test_server(gnutls_session_t session)
+{
+	int ret, i = 0;
+	static char buf[5 * 1024];
+	char *p;
+	const char snd_buf[] = "GET / HTTP/1.0\r\n\r\n";
+
+	buf[sizeof(buf) - 1] = 0;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":" ALL_KX ":" "%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret != TEST_SUCCEED)
+		return TEST_FAILED;
+
+	gnutls_record_send(session, snd_buf, sizeof(snd_buf) - 1);
+	ret = gnutls_record_recv(session, buf, sizeof(buf) - 1);
+	if (ret < 0)
+		return TEST_FAILED;
+
+	ext_text = "unknown";
+	p = strstr(buf, "Server:");
+	if (p != NULL) {
+		p+=7;
+		if (*p == ' ') p++;
+		ext_text = p;
+		while (*p != 0 && *p != '\r' && *p != '\n') {
+			p++;
+			i++;
+			if (i > 128)
+				break;
+		}
+		*p = 0;
+	}
+
+	return TEST_SUCCEED;
+}
+
+static gnutls_datum_t pubkey = { NULL, 0 };
+
+test_code_t test_dhe(gnutls_session_t session)
+{
+#ifdef ENABLE_DHE
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+DHE-RSA:+DHE-DSS:%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	gnutls_dh_get_pubkey(session, &pubkey);
+
+	return ret;
+#endif
+	return TEST_IGNORE;
+}
+
+test_code_t test_rfc7919(gnutls_session_t session)
+{
+#ifdef ENABLE_DHE
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+DHE-RSA:+DHE-DSS:+GROUP-ALL:%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret != TEST_FAILED && (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_RFC7919))
+		return TEST_SUCCEED;
+	else
+		return TEST_FAILED;
+#endif
+	return TEST_IGNORE;
+}
+
+test_code_t test_ecdhe(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+ECDHE-RSA:+ECDHE-ECDSA:+CURVE-ALL:%s", protocol_all_str,
+		rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	return ret;
+}
+
+#ifdef ENABLE_GOST
+test_code_t test_vko_gost_12(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+VKO-GOST-12:%s", protocol_all_str,
+		rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	return ret;
+}
+#endif
+
+test_code_t test_rsa(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+RSA:%s", protocol_all_str,
+		rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	return ret;
+}
+
+static
+test_code_t test_ecdhe_curve(gnutls_session_t session, const char *curve, unsigned id)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	/* We always enable all the curves but set our selected as first. That is
+	 * because list of curves may be also used by the server to select a cert. */
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+ECDHE-RSA:+ECDHE-ECDSA:%s:%s", protocol_all_str, curve, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	if (gnutls_ecc_curve_get(session) != id)
+		return TEST_FAILED;
+
+	return TEST_SUCCEED;
+}
+
+test_code_t test_ecdhe_secp256r1(gnutls_session_t session)
+{
+	return test_ecdhe_curve(session, "+CURVE-SECP256R1", GNUTLS_ECC_CURVE_SECP256R1);
+}
+
+test_code_t test_ecdhe_secp384r1(gnutls_session_t session)
+{
+	return test_ecdhe_curve(session, "+CURVE-SECP384R1", GNUTLS_ECC_CURVE_SECP384R1);
+}
+
+test_code_t test_ecdhe_secp521r1(gnutls_session_t session)
+{
+	return test_ecdhe_curve(session, "+CURVE-SECP521R1", GNUTLS_ECC_CURVE_SECP521R1);
+}
+
+test_code_t test_ecdhe_x25519(gnutls_session_t session)
+{
+	return test_ecdhe_curve(session, "+CURVE-X25519", GNUTLS_ECC_CURVE_X25519);
+}
+
+test_code_t test_rfc7507(gnutls_session_t session)
+{
+	int ret;
+	const char *pstr = NULL;
+
+	if (tls1_2_ok && tls1_1_ok)
+		pstr = "-VERS-TLS-ALL:+VERS-TLS1.1:%FALLBACK_SCSV";
+	else if (tls1_1_ok && tls1_ok)
+		pstr = "-VERS-TLS-ALL:+VERS-TLS1.0:%FALLBACK_SCSV";
+#ifdef ENABLE_SSL3
+	else if (tls1_ok && ssl3_ok)
+		pstr = "-VERS-TLS-ALL:+VERS-SSL3.0:%FALLBACK_SCSV";
+#endif
+	else
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":"ALL_KX":%s", pstr, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret < 0)
+		return TEST_IGNORE2;
+
+	if (handshake_output < 0)
+		return TEST_SUCCEED;
+
+	return TEST_FAILED;
+}
+
+
+test_code_t test_safe_renegotiation(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":" ALL_KX ":%s:%%SAFE_RENEGOTIATION", rest, protocol_str);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	return ret;
+}
+
+#ifdef ENABLE_OCSP
+test_code_t test_ocsp_status(gnutls_session_t session)
+{
+	int ret;
+	gnutls_datum_t resp;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":" ALL_KX":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_ocsp_status_request_enable_client(session, NULL, 0, NULL);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	ret = gnutls_ocsp_status_request_get(session, &resp);
+	if (ret == 0)
+		return TEST_SUCCEED;
+
+
+	return TEST_FAILED;
+}
+
+#endif
+
+test_code_t test_ext_master_secret(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":%s:" ALL_KX, rest, protocol_str);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	if (gnutls_session_ext_master_secret_status(session) != 0)
+		return TEST_SUCCEED;
+
+	return TEST_FAILED;
+}
+
+test_code_t test_etm(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		"+AES-128-CBC:+AES-256-CBC:" ALL_COMP ":%s:" ALL_MACS
+		":%s:" ALL_KX, rest, protocol_str);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	if (ret < 0)
+		return TEST_FAILED;
+
+	if (gnutls_session_etm_status(session) != 0)
+		return TEST_SUCCEED;
+
+	return TEST_FAILED;
+}
+
+test_code_t test_safe_renegotiation_scsv(gnutls_session_t session)
+{
+	int ret;
+
+	if (ssl3_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":+VERS-TLS1.0:"
+		ALL_MACS ":" ALL_KX ":%%SAFE_RENEGOTIATION");
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	return ret;
+}
+
+test_code_t test_dhe_group(gnutls_session_t session)
+{
+	int ret, ret2;
+	gnutls_datum_t gen, prime, pubkey2;
+	const char *print;
+	FILE *fp;
+
+	(void)remove("debug-dh.out");
+
+	if (verbose == 0 || pubkey.data == NULL)
+		return TEST_IGNORE;
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":+DHE-RSA:+DHE-DSS:%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+
+	ret2 = gnutls_dh_get_group(session, &gen, &prime);
+	if (ret2 >= 0) {
+
+		fp = fopen("debug-dh.out", "w");
+		if (fp == NULL)
+			return TEST_FAILED;
+
+		ext_text = "saved in debug-dh.out";
+
+		print = raw_to_string(gen.data, gen.size);
+		if (print) {
+			fprintf(fp, " Generator [%d bits]: %s\n", gen.size * 8,
+				print);
+		}
+
+		print = raw_to_string(prime.data, prime.size);
+		if (print) {
+			fprintf(fp, " Prime [%d bits]: %s\n", prime.size * 8,
+				print);
+		}
+
+		gnutls_dh_get_pubkey(session, &pubkey2);
+		print = raw_to_string(pubkey2.data, pubkey2.size);
+		if (print) {
+			fprintf(fp, " Pubkey [%d bits]: %s\n", pubkey2.size * 8,
+				print);
+		}
+
+		if (pubkey2.data && pubkey2.size == pubkey.size &&
+		    memcmp(pubkey.data, pubkey2.data, pubkey.size) == 0) {
+			fprintf
+			    (fp, " (public key seems to be static among sessions)\n");
+		}
+
+		{
+			/* save the PKCS #3 params */
+			gnutls_dh_params_t dhp;
+			gnutls_datum_t p3;
+			
+			ret2 = gnutls_dh_params_init(&dhp);
+			if (ret2 < 0) {
+				fclose(fp);
+				return TEST_FAILED;
+			}
+
+			ret2 = gnutls_dh_params_import_raw(dhp, &prime, &gen);
+			if (ret2 < 0) {
+				gnutls_dh_params_deinit(dhp);
+				fclose(fp);
+				return TEST_FAILED;
+			}
+
+			ret2 = gnutls_dh_params_export2_pkcs3(dhp, GNUTLS_X509_FMT_PEM, &p3);
+			if (ret2 < 0) {
+				gnutls_dh_params_deinit(dhp);
+				fclose(fp);
+				return TEST_FAILED;
+			}
+
+			gnutls_dh_params_deinit(dhp);
+			fprintf(fp, "\n%s\n", p3.data);
+			gnutls_free(p3.data);
+		}
+
+		fclose(fp);
+	}
+	return ret;
+}
+
+test_code_t test_ssl3(gnutls_session_t session)
+{
+	int ret;
+	sprintf(prio_str, INIT_STR
+		SSL3_CIPHERS ":" ALL_COMP ":+VERS-SSL3.0:%%NO_EXTENSIONS:"
+		SSL3_MACS ":" SSL3_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		ssl3_ok = 1;
+
+	return ret;
+}
+
+test_code_t test_ssl3_with_extensions(gnutls_session_t session)
+{
+	int ret;
+	sprintf(prio_str, INIT_STR
+		SSL3_CIPHERS ":" ALL_COMP ":+VERS-SSL3.0:"
+		SSL3_MACS ":" SSL3_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ssl3_ok != 0 && ret != TEST_SUCCEED) {
+		/* We need to disable extensions before trying TLS 1.0, because
+		 * it also may not work with extensions. There are known servers
+		 * which partially support both SSL 3.0 and TLS 1.0, but *both*
+		 * only with disabled extensions:
+		 *   https://gitlab.com/gnutls/gnutls/-/issues/958#note_309267384
+		 */
+		tls_ext_ok = 0;
+		strcat(rest, ":%NO_EXTENSIONS");
+	}
+
+	return ret;
+}
+
+test_code_t test_ssl3_unknown_ciphersuites(gnutls_session_t session)
+{
+	int ret;
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":+VERS-SSL3.0:"
+		ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		ssl3_ok = 1;
+
+	return ret;
+}
+
+static int alrm = 0;
+static void got_alarm(int k)
+{
+	alrm = 1;
+}
+
+test_code_t test_bye(gnutls_session_t session)
+{
+	int ret;
+	char data[20];
+	int secs = 6;
+#ifndef _WIN32
+	struct sigaction sa, old_sa;
+
+	signal(SIGALRM, got_alarm);
+#endif
+
+	sprintf(prio_str, INIT_STR
+		ALL_CIPHERS ":" ALL_COMP ":%s:" ALL_MACS
+		":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return ret;
+
+	ret = gnutls_bye(session, GNUTLS_SHUT_WR);
+	if (ret < 0)
+		return TEST_FAILED;
+
+#ifndef _WIN32
+	(void) sigaction (SIGALRM, NULL, &sa);
+	sa.sa_flags &= ~SA_RESTART;
+	sigaction(SIGALRM, &sa, &old_sa);
+	alarm(secs);
+#else
+	setsockopt((int) gnutls_transport_get_ptr(session), SOL_SOCKET,
+		   SO_RCVTIMEO, (char *) &secs, sizeof(int));
+#endif
+
+	do {
+		ret = gnutls_record_recv(session, data, sizeof(data));
+	}
+	while (ret > 0);
+
+#ifndef _WIN32
+	sigaction(SIGALRM, &old_sa, NULL);
+#else
+	if (WSAGetLastError() == WSAETIMEDOUT ||
+	    WSAGetLastError() == WSAECONNABORTED)
+		alrm = 1;
+#endif
+	if (ret == 0)
+		return TEST_SUCCEED;
+
+	if (alrm == 0)
+		return TEST_UNSURE;
+
+	return TEST_FAILED;
+}
+
+
+
+test_code_t test_aes(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		"+AES-128-CBC:+AES-256-CBC:" ALL_COMP ":%s:" ALL_MACS
+		":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_aes_gcm(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		"+AES-128-GCM:+AES-256-GCM:" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s",
+		protocol_all_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_aes_ccm(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		"+AES-128-CCM:+AES-256-CCM:" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s",
+		protocol_all_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_aes_ccm_8(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, INIT_STR
+		"+AES-128-CCM-8:+AES-256-CCM-8:" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s",
+		protocol_all_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_camellia_cbc(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR "+CAMELLIA-128-CBC:+CAMELLIA-256-CBC:" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_camellia_gcm(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR "+CAMELLIA-128-GCM:+CAMELLIA-256-GCM:" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_unknown_ciphersuites(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":%s:" ALL_MACS ":" ALL_KX ":%s",
+		protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_md5(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":%s:+MD5:" ALL_KX ":%s", protocol_str,
+		rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_sha(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR  ALL_CIPHERS ":" ALL_COMP
+		":%s:+SHA1:" ALL_KX ":%s", protocol_str,
+		rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_sha256(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":%s:+SHA256:" ALL_KX ":%s",
+		protocol_all_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+#ifdef ENABLE_GOST
+test_code_t test_gost_imit(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":%s:+GOST28147-TC26Z-IMIT:" ALL_KX ":%s",
+		protocol_all_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+#endif
+
+test_code_t test_3des(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR "+3DES-CBC:" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_arcfour(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR "+ARCFOUR-128:" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_chacha20(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR "+CHACHA20-POLY1305:" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+#ifdef ENABLE_GOST
+test_code_t test_gost_cnt(gnutls_session_t session)
+{
+	int ret;
+
+	if (gnutls_fips140_mode_enabled())
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR "+GOST28147-TC26Z-CNT:" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+#endif
+
+test_code_t test_tls1(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.0:%%SSL3_RECORD_VERSION:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		tls1_ok = 1;
+
+	return ret;
+
+}
+
+test_code_t test_tls1_nossl3(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls1_ok != 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.0:%%LATEST_RECORD_VERSION:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED) {
+		strcat(rest, ":%LATEST_RECORD_VERSION");
+		tls1_ok = 1;
+	}
+
+	return ret;
+
+}
+
+test_code_t test_record_padding(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR BLOCK_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:-VERS-SSL3.0:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED) {
+		tls1_ok = 1;
+	} else {
+		sprintf(prio_str,
+			INIT_STR BLOCK_CIPHERS ":" ALL_COMP
+			":+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:-VERS-SSL3.0:" ALL_MACS ":" ALL_KX ":%%COMPAT:%s", rest);
+		_gnutls_priority_set_direct(session, prio_str);
+
+		gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+		ret = test_do_handshake(session);
+		if (ret == TEST_SUCCEED) {
+			tls1_ok = 1;
+			strcat(rest, ":%COMPAT");
+		} else
+			ret = TEST_IGNORE2; /* neither succeeded */
+	}
+
+	return ret;
+}
+
+test_code_t test_no_extensions(gnutls_session_t session)
+{
+	int ret;
+
+#ifdef ENABLE_SSL3
+	/* If already disabled by test_ssl3_with_extensions */
+	if (ssl3_ok != 0 && tls_ext_ok == 0)
+		return TEST_FAILED;
+#endif
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_record_set_max_size(session, 4096);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED) {
+		tls_ext_ok = 1;
+	} else {
+		sprintf(prio_str,
+			INIT_STR BLOCK_CIPHERS ":" ALL_COMP
+			":+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:-VERS-SSL3.0:" ALL_MACS ":" ALL_KX ":%%NO_EXTENSIONS:%s", rest);
+		_gnutls_priority_set_direct(session, prio_str);
+
+		gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+		ret = test_do_handshake(session);
+		if (ret == TEST_SUCCEED) {
+			tls_ext_ok = 0;
+			strcat(rest, ":%NO_EXTENSIONS");
+		} else
+			ret = TEST_IGNORE2; /* neither succeeded */
+	}
+
+	return ret;
+}
+
+test_code_t test_known_protocols(gnutls_session_t session)
+{
+	if (tls1_2_ok == 0 && tls1_1_ok == 0 && tls1_ok == 0 &&
+	    ssl3_ok == 0 && tls1_3_ok == 0)
+		return TEST_FAILED;
+
+	return TEST_SUCCEED;
+}
+
+test_code_t test_tls1_2(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.2:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		tls1_2_ok = 1;
+
+	return ret;
+
+}
+
+test_code_t test_tls1_3(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.3:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		tls1_3_ok = 1;
+
+	return ret;
+
+}
+
+test_code_t test_tls1_1(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.1:" ALL_MACS ":" ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_SUCCEED)
+		tls1_1_ok = 1;
+
+	return ret;
+
+}
+
+test_code_t test_tls1_1_fallback(gnutls_session_t session)
+{
+	int ret;
+	if (tls1_1_ok)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:" ALL_MACS ":"
+		ALL_KX ":%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret != TEST_SUCCEED)
+		return TEST_FAILED;
+
+	if (gnutls_protocol_get_version(session) == GNUTLS_TLS1)
+		return TEST_SUCCEED;
+	else if (gnutls_protocol_get_version(session) == GNUTLS_SSL3)
+		return TEST_UNSURE;
+
+	return TEST_FAILED;
+
+}
+
+test_code_t test_tls1_6_fallback(gnutls_session_t session)
+{
+	int ret;
+
+	/* we remove RSA as there is a version check in the key exchange
+	 * message we do not properly set in this test */
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP
+		":+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:" ALL_MACS ":"
+		ALL_KX ":-RSA:%s", rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	_gnutls_hello_set_default_version(session, 3, 7);
+
+	ret = test_do_handshake(session);
+	if (ret != TEST_SUCCEED)
+		return TEST_FAILED;
+
+	ext_text = gnutls_protocol_get_name(gnutls_protocol_get_version(session));
+	return TEST_SUCCEED;
+}
+
+/* Advertise both TLS 1.0 and SSL 3.0. If the connection fails,
+ * but the previous SSL 3.0 test succeeded then disable TLS 1.0.
+ */
+test_code_t test_tls_disable0(gnutls_session_t session)
+{
+	int ret;
+	if (tls1_ok != 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED) {
+		/* disable TLS 1.0 */
+		if (ssl3_ok != 0) {
+			strcpy(protocol_str, "+VERS-SSL3.0");
+		}
+	}
+	return ret;
+
+}
+
+test_code_t test_tls_disable1(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls1_1_ok != 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED) {
+		/* disable TLS 1.1 */
+		snprintf(protocol_str, sizeof(protocol_str), "+VERS-TLS1.0:+VERS-SSL3.0");
+	}
+	return ret;
+}
+
+test_code_t test_tls_disable2(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls1_2_ok != 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED) {
+		/* disable TLS 1.2 */
+		snprintf(protocol_str, sizeof(protocol_str), "+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0");
+	}
+	return ret;
+}
+
+
+test_code_t test_rsa_pms(gnutls_session_t session)
+{
+	int ret;
+
+	/* here we enable both SSL 3.0 and TLS 1.0
+	 * and try to connect and use rsa authentication.
+	 * If the server is old, buggy and only supports
+	 * SSL 3.0 then the handshake will fail.
+	 */
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":+RSA:%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return TEST_FAILED;
+
+	if (gnutls_protocol_get_version(session) == GNUTLS_TLS1)
+		return TEST_SUCCEED;
+	return TEST_UNSURE;
+}
+
+test_code_t test_max_record_size(gnutls_session_t session)
+{
+	int ret;
+
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_record_set_max_size(session, 512);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return ret;
+
+	ret = gnutls_record_get_max_size(session);
+	if (ret == 512)
+		return TEST_SUCCEED;
+
+	return TEST_FAILED;
+}
+
+test_code_t test_heartbeat_extension(gnutls_session_t session)
+{
+	if (tls_ext_ok == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_record_set_max_size(session, 4096);
+
+	gnutls_heartbeat_enable(session, GNUTLS_HB_PEER_ALLOWED_TO_SEND);
+	test_do_handshake(session);
+
+	switch (gnutls_heartbeat_allowed(session, GNUTLS_HB_LOCAL_ALLOWED_TO_SEND)) {
+	case 0:
+		return TEST_FAILED;
+	default:
+		return TEST_SUCCEED;
+	}
+}
+
+test_code_t test_small_records(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_record_set_max_size(session, 512);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+test_code_t test_version_rollback(gnutls_session_t session)
+{
+	int ret;
+	if (tls1_ok == 0)
+		return TEST_IGNORE;
+
+	/* here we enable both SSL 3.0 and TLS 1.0
+	 * and we connect using a 3.1 client hello version,
+	 * and a 3.0 record version. Some implementations
+	 * are buggy (and vulnerable to man in the middle
+	 * attacks which allow a version downgrade) and this 
+	 * connection will fail.
+	 */
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	_gnutls_record_set_default_version(session, 3, 0);
+
+	ret = test_do_handshake(session);
+	if (ret != TEST_SUCCEED)
+		return ret;
+
+	if (tls1_ok != 0
+	    && gnutls_protocol_get_version(session) == GNUTLS_SSL3)
+		return TEST_FAILED;
+
+	return TEST_SUCCEED;
+}
+
+/* See if the server tolerates out of bounds
+ * record layer versions in the first client hello
+ * message.
+ */
+test_code_t test_version_oob(gnutls_session_t session)
+{
+	int ret;
+	/* here we enable both SSL 3.0 and TLS 1.0
+	 * and we connect using a 5.5 record version.
+	 */
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	_gnutls_record_set_default_version(session, 5, 5);
+
+	ret = test_do_handshake(session);
+	return ret;
+}
+
+void _gnutls_rsa_pms_set_version(gnutls_session_t session,
+				 unsigned char major, unsigned char minor);
+
+test_code_t test_rsa_pms_version_check(gnutls_session_t session)
+{
+	int ret;
+	/* here we use an arbitrary version in the RSA PMS
+	 * to see whether to server will check this version.
+	 *
+	 * A normal server would abort this handshake.
+	 */
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	_gnutls_rsa_pms_set_version(session, 5, 5);	/* use SSL 5.5 version */
+
+	ret = test_do_handshake(session);
+	return ret;
+
+}
+
+#ifdef ENABLE_ANON
+test_code_t test_anonymous(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":+ANON-DH:+ANON-ECDH:+CURVE-ALL:%s",
+		protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred);
+
+	ret = test_do_handshake(session);
+
+	if (ret == TEST_SUCCEED)
+		gnutls_dh_get_pubkey(session, &pubkey);
+
+	return ret;
+}
+#endif
+
+test_code_t test_session_resume2(gnutls_session_t session)
+{
+	int ret;
+	char tmp_session_id[32];
+	size_t tmp_session_id_size;
+
+	if (session == NULL)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred);
+
+	gnutls_session_set_data(session, session_data, session_data_size);
+
+	memcpy(tmp_session_id, session_id, session_id_size);
+	tmp_session_id_size = session_id_size;
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return ret;
+
+	/* check if we actually resumed the previous session */
+
+	session_id_size = sizeof(session_id);
+	gnutls_session_get_id(session, session_id, &session_id_size);
+
+	if (session_id_size == 0)
+		return TEST_FAILED;
+
+	if (gnutls_session_is_resumed(session))
+		return TEST_SUCCEED;
+
+	if (tmp_session_id_size == session_id_size &&
+	    memcmp(tmp_session_id, session_id, tmp_session_id_size) == 0)
+		return TEST_SUCCEED;
+	else
+		return TEST_FAILED;
+}
+
+extern char *hostname;
+
+test_code_t test_certificate(gnutls_session_t session)
+{
+	int ret;
+	FILE *fp;
+
+	(void)remove("debug-certs.out");
+
+	if (verbose == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return ret;
+
+	fp = fopen("debug-certs.out", "w");
+	if (fp != NULL) {
+		fprintf(fp, "\n");
+		print_cert_info2(session, GNUTLS_CRT_PRINT_FULL, fp, verbose);
+		fclose(fp);
+		ext_text = "saved in debug-certs.out";
+		return TEST_SUCCEED;
+	}
+	return TEST_FAILED;
+}
+
+test_code_t test_chain_order(gnutls_session_t session)
+{
+	int ret;
+	const gnutls_datum_t *cert_list;
+	unsigned int cert_list_size = 0;
+	unsigned int i;
+	unsigned p_size;
+	gnutls_datum_t t;
+	gnutls_x509_crt_t *certs;
+	char *p, *pos;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake(session);
+	if (ret == TEST_FAILED)
+		return ret;
+
+	if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
+		return TEST_IGNORE2;
+
+	cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
+	if (cert_list_size == 0) {
+		ext_text = "No certificates found!";
+		return TEST_IGNORE2;
+	}
+
+	if (cert_list_size == 1)
+		return TEST_SUCCEED;
+
+	p = 0;
+	p_size = 0;
+	pos = NULL;
+	for (i=0;i<cert_list_size;i++) {
+		char *new_p;
+		t.data = NULL;
+		ret = gnutls_pem_base64_encode_alloc("CERTIFICATE", &cert_list[i], &t);
+		if (ret < 0) {
+			free(p);
+			return TEST_FAILED;
+		}
+
+		new_p = realloc(p, p_size+t.size+1);
+		if (!new_p) {
+			free(p);
+			return TEST_FAILED;
+		}
+		p = new_p;
+		pos = p + p_size;
+
+		memcpy(pos, t.data, t.size);
+		p_size += t.size;
+		pos += t.size;
+
+		gnutls_free(t.data);
+	}
+	*pos = 0;
+
+	t.size = p_size;
+	t.data = (void*)p;
+
+	p_size = 0;
+	ret = gnutls_x509_crt_list_import2(&certs, &p_size, &t, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED);
+	if (ret < 0) {
+		return TEST_FAILED;
+	}
+
+	for (i=0;i<p_size;i++) {
+		gnutls_x509_crt_deinit(certs[i]);
+	}
+	gnutls_free(certs);
+	free(p);
+
+	return TEST_SUCCEED;
+}
+
+/* A callback function to be used at the certificate selection time.
+ */
+static int
+cert_callback(gnutls_session_t session,
+	      const gnutls_datum_t * req_ca_rdn, int nreqs,
+	      const gnutls_pk_algorithm_t * sign_algos,
+	      int sign_algos_length, gnutls_retr2_st * st)
+{
+	char issuer_dn[256];
+	int i, ret;
+	size_t len;
+	FILE *fp;
+
+	if (verbose == 0)
+		return -1;
+
+	fp = fopen("debug-cas.out", "w");
+	if (fp == NULL)
+		return -1;
+
+	/* Print the server's trusted CAs
+	 */
+	printf("\n");
+	if (nreqs > 0)
+		fprintf(fp, "- Server's trusted authorities:\n");
+	else
+		fprintf
+		    (fp, "- Server did not send us any trusted authorities names.\n");
+
+	/* print the names (if any) */
+	for (i = 0; i < nreqs; i++) {
+		len = sizeof(issuer_dn);
+		ret = gnutls_x509_rdn_get(&req_ca_rdn[i], issuer_dn, &len);
+		if (ret >= 0) {
+			fprintf(fp, "   [%d]: ", i);
+			fprintf(fp, "%s\n", issuer_dn);
+		}
+	}
+	fclose(fp);
+
+	return -1;
+
+}
+
+/* Prints the trusted server's CAs. This is only
+ * if the server sends a certificate request packet.
+ */
+test_code_t test_server_cas(gnutls_session_t session)
+{
+	int ret;
+
+	(void)remove("debug-cas.out");
+	if (verbose == 0)
+		return TEST_IGNORE;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+	gnutls_certificate_set_retrieve_function(xcred, cert_callback);
+
+	ret = test_do_handshake(session);
+	gnutls_certificate_set_retrieve_function(xcred, NULL);
+
+	if (ret == TEST_FAILED)
+		return ret;
+
+	if (access("debug-cas.out", R_OK) == 0)
+		ext_text = "saved in debug-cas.out";
+	else
+		ext_text = "none";
+	return TEST_SUCCEED;
+}
+
+static test_code_t
+test_do_handshake_and_send_record(gnutls_session_t session)
+{
+	int ret;
+	/* This will be padded to 512 bytes. */
+	const char snd_buf[] = "GET / HTTP/1.0\r\n\r\n";
+	static char buf[5 * 1024];
+
+	ret = test_do_handshake(session);
+	if (ret != TEST_SUCCEED)
+		return ret;
+
+	gnutls_record_send(session, snd_buf, sizeof(snd_buf) - 1);
+	ret = gnutls_record_recv(session, buf, sizeof(buf) - 1);
+	if (ret < 0)
+		return TEST_FAILED;
+
+	return TEST_SUCCEED;
+}
+
+/* These tests shall be sent in this order to check if the server
+ * advertises smaller limits than our default 512. and we can work it
+ * around with %ALLOW_SMALL_RECORDS. */
+test_code_t test_send_record(gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%s", protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake_and_send_record(session);
+	if (ret == TEST_SUCCEED)
+		send_record_ok = 1;
+	return ret;
+}
+
+test_code_t test_send_record_with_allow_small_records(gnutls_session_t session)
+{
+	int ret;
+
+	/* If test_send_record succeeded, we don't need to check. */
+	if (send_record_ok)
+		return TEST_FAILED;
+
+	sprintf(prio_str,
+		INIT_STR ALL_CIPHERS ":" ALL_COMP ":%s:"
+		ALL_MACS ":" ALL_KX ":%%ALLOW_SMALL_RECORDS:%s",
+		protocol_str, rest);
+	_gnutls_priority_set_direct(session, prio_str);
+	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = test_do_handshake_and_send_record(session);
+	if (ret == TEST_SUCCEED)
+		strcat(rest, ":%ALLOW_SMALL_RECORDS");
+	return ret;
+}