Introduced gnutls_session_enable_compatibility_mode() to allow enabling

all supported compatibility options (like disabling padding). Some other bug fixes
in tls-test.c.

7 files changed, 39 insertions, 10 deletions

diff --git a/NEWS b/NEWS
index c5e2bc0c06..b30bf15e86 100644
--- a/NEWS
+++ b/NEWS
@@ -14,8 +14,11 @@ version 1 certificates.
 buggy clients that complain if the TLS 1.0 record protocol padding is
 used.
 
+** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
+all supported compatibility options (like disabling padding).
 
 ** API and ABI modifications:
+gnutls_session_enable_compatibility_mode: ADDED
 gnutls_record_disable_padding: ADDED
 gnutls_mac_convert_priority: ADDED
 gnutls_compression_convert_priority: ADDED
diff --git a/doc/examples/ex-serv1.c b/doc/examples/ex-serv1.c
index 6ea17b584f..e331542a05 100644
--- a/doc/examples/ex-serv1.c
+++ b/doc/examples/ex-serv1.c
@@ -55,8 +55,11 @@ initialize_tls_session (void)
   /* request client certificate if any.
    */
   gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
-
-  gnutls_dh_set_prime_bits (session, DH_BITS);
+  
+  /* Set maximum compatibility mode. This is only suggested on public webservers
+   * that need to trade security for compatibility
+   */
+  gnutls_session_enable_compatibility_mode( session);
 
   return session;
 }
diff --git a/includes/gnutls/gnutls.h.in b/includes/gnutls/gnutls.h.in
index fa540b547b..345752474b 100644
--- a/includes/gnutls/gnutls.h.in
+++ b/includes/gnutls/gnutls.h.in
@@ -431,6 +431,8 @@ extern "C"
 #define gnutls_read gnutls_record_recv
 #define gnutls_write gnutls_record_send
 
+  void gnutls_session_enable_compatibility_mode (gnutls_session_t session);
+
   void gnutls_record_disable_padding (gnutls_session_t session);
 
   int gnutls_record_get_direction (gnutls_session_t session);
diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index 0b3c9e2c49..70d1e1c115 100644
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -1230,3 +1230,22 @@ void gnutls_handshake_set_post_client_hello_function( gnutls_session_t session,
 {
   session->internals.user_hello_func = func;
 }
+
+/**
+  * gnutls_session_enable_compatibility_mode - Used to disable certain features in TLS in order to honour compatibility
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function can be used to disable certain (security) features in TLS
+  * in order to maintain maximum compatibility with buggy clients. It is
+  * equivalent to calling:
+  * gnutls_record_disable_padding()
+
+  * Normally only servers that require maximum compatibility with everything
+  * out there, need to call this function.
+  *
+  **/
+void
+gnutls_session_enable_compatibility_mode (gnutls_session_t session)
+{
+  gnutls_record_disable_padding( session);
+}
diff --git a/src/serv.c b/src/serv.c
index e5c54f75f3..067c05be93 100644
--- a/src/serv.c
+++ b/src/serv.c
@@ -414,6 +414,11 @@ initialize_session (void)
       gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
   }
 
+  /* Set maximum compatibility mode. This is only suggested on public webservers
+   * that need to trade security for compatibility
+   */
+   gnutls_session_enable_compatibility_mode( session);
+
 #ifdef ENABLE_OPRFI
   if (info.opaque_prf_input)
     gnutls_oprfi_enable_server (session, oprfi_callback, NULL);
diff --git a/src/tests.c b/src/tests.c
index bc9bc11be9..0818acb55c 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -50,7 +50,7 @@ int tls1_1_ok = 0;
 /* keep session info */
 static char *session_data = NULL;
 static char session_id[32];
-static int session_data_size = 0, session_id_size = 0;
+static size_t session_data_size = 0, session_id_size = 0;
 static int sfree = 0;
 static int handshake_output = 0;
 
@@ -217,13 +217,10 @@ ADD_PROTOCOL3 (gnutls_session_t session, int p1, int p2, int p3)
 static int srp_detected;
 
 int
-_test_srp_username_callback (gnutls_session_t session, unsigned int times,
-			     char **username, char **password)
+_test_srp_username_callback (gnutls_session_t session, 
+    char **username, char **password)
 {
-  if (times == 1)
-    {
-      srp_detected = 1;
-    }
+  srp_detected = 1;
 
   return -1;
 }
diff --git a/src/tests.h b/src/tests.h
index bfb357f927..2f27f85037 100644
--- a/src/tests.h
+++ b/src/tests.h
@@ -38,5 +38,5 @@ test_code_t test_rsa_pms_version_check (gnutls_session_t session);
 test_code_t test_version_oob (gnutls_session_t session);
 test_code_t test_zlib (gnutls_session_t session);
 test_code_t test_lzo (gnutls_session_t session);
-int _test_srp_username_callback (gnutls_session_t session, unsigned int times,
+int _test_srp_username_callback (gnutls_session_t session,
 				 char **username, char **password);