Re: [TLS] [FORGED] Re: no fallbacks please [was: Downgrade protection, fallbacks, and server time]

[Hubert Kario <[e-mail]>]

On Thursday 09 June 2016 05:48:15 Peter Gutmann wrote:
> Hubert Kario <[e-mail]> writes:
> >The first one is:
> >https://github.com/tomato42/tlsfuzzer
> >and aims to be a comprehensive test suite
> 
> Very nice, just setting it up now.  One minor request, it'd be useful
> to have a run-evening wrapper script that steps through each test
> reporting what's happening, so first to a standard connec to make
> sure all is OK, then run the various tests.  I'll hack toether a
> shell script in a minute, but having an official way of doing it
> would be nice.

run _everything_ is not really possible as some tests actually require 
mutually exclusive server settings - e.g. some require the server not to 
ask for client certificate while others do

later in tests I've started adding a "sanity check" test case (see 
"test-certificate-verify.py"), but I didn't yet have time to do that for 
all

all in all, I won't hide that they are very rough, but this is not the 
intended user interface; the scripts are just proof-of-concept for the 
test engine, there will be two levels above it before the real user 
interface will come into play

finally, while I do look forward to any contributions (just ideas for 
tests would be huge help!) I do want the tool to be as platform 
independent as possible (require just Python runtime, be it 2.6, 3.5 or 
anything in-between), so if you do plan to write the script, may I ask 
you to do that in python too?
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic