Index: gnutls-2.4.1/configure
===================================================================
--- gnutls-2.4.1.orig/configure
+++ gnutls-2.4.1/configure
@@ -46596,7 +46596,7 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
 
-ac_config_files="$ac_config_files Makefile po/Makefile.in doc/Makefile doc/examples/Makefile doc/scripts/Makefile doc/manpages/Makefile doc/reference/Makefile doc/credentials/Makefile doc/credentials/x509/Makefile doc/credentials/srp/Makefile doc/credentials/openpgp/Makefile gl/Makefile lgl/Makefile tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile tests/pkcs12-decode/Makefile tests/pathlen/Makefile tests/key-id/Makefile tests/sha2/Makefile tests/hostname-check/Makefile includes/Makefile includes/gnutls/gnutls.h lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile libextra/Makefile lib/openpgp/Makefile lib/opencdk/Makefile tests/openpgp/Makefile tests/openpgp-certs/Makefile src/Makefile src/cfg/Makefile src/cfg/platon/Makefile src/cfg/platon/str/Makefile lib/libgnutls-config libextra/libgnutls-extra-config lib/gnutls.pc libextra/gnutls-extra.pc guile/Makefile guile/modules/Makefile guile/src/Makefile guile/tests/Makefile"
+ac_config_files="$ac_config_files Makefile po/Makefile.in doc/Makefile doc/examples/Makefile doc/scripts/Makefile doc/manpages/Makefile doc/reference/Makefile doc/credentials/Makefile doc/credentials/x509/Makefile doc/credentials/srp/Makefile doc/credentials/openpgp/Makefile gl/Makefile lgl/Makefile tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile tests/pkcs12-decode/Makefile tests/pathlen/Makefile tests/key-id/Makefile tests/sha2/Makefile tests/hostname-check/Makefile includes/Makefile includes/gnutls/gnutls.h lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile libextra/Makefile lib/openpgp/Makefile lib/opencdk/Makefile tests/openpgp/Makefile tests/openpgp-certs/Makefile tests/safe-renegotiation/Makefile src/Makefile src/cfg/Makefile src/cfg/platon/Makefile src/cfg/platon/str/Makefile lib/libgnutls-config libextra/libgnutls-extra-config lib/gnutls.pc libextra/gnutls-extra.pc guile/Makefile guile/modules/Makefile guile/src/Makefile guile/tests/Makefile"
 
 
 ac_config_files="$ac_config_files guile/pre-inst-guile"
@@ -47481,6 +47481,7 @@ do
     "lib/opencdk/Makefile") CONFIG_FILES="$CONFIG_FILES lib/opencdk/Makefile" ;;
     "tests/openpgp/Makefile") CONFIG_FILES="$CONFIG_FILES tests/openpgp/Makefile" ;;
     "tests/openpgp-certs/Makefile") CONFIG_FILES="$CONFIG_FILES tests/openpgp-certs/Makefile" ;;
+    "tests/safe-renegotiation/Makefile") CONFIG_FILES="$CONFIG_FILES tests/safe-renegotiation/Makefile" ;;
     "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;;
     "src/cfg/Makefile") CONFIG_FILES="$CONFIG_FILES src/cfg/Makefile" ;;
     "src/cfg/platon/Makefile") CONFIG_FILES="$CONFIG_FILES src/cfg/platon/Makefile" ;;
Index: gnutls-2.4.1/includes/gnutls/gnutls.h.in
===================================================================
--- gnutls-2.4.1.orig/includes/gnutls/gnutls.h.in
+++ gnutls-2.4.1/includes/gnutls/gnutls.h.in
@@ -481,6 +481,9 @@ extern "C"
 			      void *data, size_t * data_length,
 			      unsigned int *type, unsigned int indx);
 
+  /* Safe renegotiation */
+  int gnutls_safe_renegotiation_status (gnutls_session_t session);
+
   /* Opaque PRF Input
    * http://tools.ietf.org/id/draft-rescorla-tls-opaque-prf-input-00.txt
    */
@@ -1303,6 +1306,9 @@ extern "C"
 #define GNUTLS_E_IA_VERIFY_FAILED -104
 
 #define GNUTLS_E_UNKNOWN_ALGORITHM -105
+#define GNUTLS_E_SAFE_RENEGOTIATION_FAILED -107
+#define GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED -108
+#define GNUTLS_E_UNKNOWN_SRP_USERNAME -109
 
 #define GNUTLS_E_BASE64_ENCODING_ERROR -201
 #define GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY -202	/* obsolete */
Index: gnutls-2.4.1/lib/Makefile.am
===================================================================
--- gnutls-2.4.1.orig/lib/Makefile.am
+++ gnutls-2.4.1/lib/Makefile.am
@@ -84,7 +84,7 @@ COBJECTS = gnutls_record.c gnutls_compre
 	gnutls_x509.c ext_cert_type.c gnutls_rsa_export.c		\
 	auth_rsa_export.c ext_server_name.c auth_dh_common.c		\
 	gnutls_helper.c ext_inner_application.c \
-	gnutls_supplemental.c crypto.c random.c
+	gnutls_supplemental.c crypto.c random.c ext_safe_renegotiation.c
 
 if ENABLE_OPRFI
 COBJECTS += $(OPRFI_COBJECTS)
@@ -105,7 +105,7 @@ HFILES = debug.h gnutls_compress.h defin
 	ext_srp.h gnutls_srp.h auth_srp.h auth_srp_passwd.h		\
 	gnutls_helper.h auth_psk.h auth_psk_passwd.h			\
 	ext_inner_application.h gnutls_supplemental.h ext_oprfi.h       \
-	crypto.h random.h
+	crypto.h random.h ext_safe_renegotiation.h
 
 # Separate so we can create the documentation
 
Index: gnutls-2.4.1/lib/Makefile.in
===================================================================
--- gnutls-2.4.1.orig/lib/Makefile.in
+++ gnutls-2.4.1/lib/Makefile.in
@@ -224,7 +224,7 @@ am__objects_4 = gnutls_record.lo gnutls_
 	gnutls_state.lo gnutls_x509.lo ext_cert_type.lo \
 	gnutls_rsa_export.lo auth_rsa_export.lo ext_server_name.lo \
 	auth_dh_common.lo gnutls_helper.lo ext_inner_application.lo \
-	gnutls_supplemental.lo crypto.lo random.lo $(am__objects_3)
+	gnutls_supplemental.lo crypto.lo random.lo ext_safe_renegotiation.lo $(am__objects_3)
 am__objects_5 = ext_srp.lo gnutls_srp.lo auth_srp.lo \
 	auth_srp_passwd.lo auth_srp_sb64.lo auth_srp_rsa.lo
 am__objects_6 = auth_psk.lo auth_psk_passwd.lo gnutls_psk.lo \
@@ -731,7 +731,7 @@ COBJECTS = gnutls_record.c gnutls_compre
 	gnutls_x509.c ext_cert_type.c gnutls_rsa_export.c \
 	auth_rsa_export.c ext_server_name.c auth_dh_common.c \
 	gnutls_helper.c ext_inner_application.c gnutls_supplemental.c \
-	crypto.c random.c $(am__append_6)
+	crypto.c random.c ext_safe_renegotiation.c $(am__append_6)
 HFILES = debug.h gnutls_compress.h defines.h gnutls_cipher.h		\
 	gnutls_buffers.h gnutls_errors.h gnutls_int.h			\
 	gnutls_handshake.h gnutls_num.h gnutls_algorithms.h		\
@@ -747,7 +747,7 @@ HFILES = debug.h gnutls_compress.h defin
 	ext_srp.h gnutls_srp.h auth_srp.h auth_srp_passwd.h		\
 	gnutls_helper.h auth_psk.h auth_psk_passwd.h			\
 	ext_inner_application.h gnutls_supplemental.h ext_oprfi.h       \
-	crypto.h random.h
+	crypto.h random.h ext_safe_renegotiation.h
 
 
 # Separate so we can create the documentation
@@ -933,6 +933,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pkix_asn1_tab.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/x509_b64.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext_safe_renegotiation.Plo@am__quote@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
Index: gnutls-2.4.1/lib/ext_safe_renegotiation.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/lib/ext_safe_renegotiation.c
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009 Free Software Foundation
+ *
+ * Author: Steve Dispensa (<dispensa@phonefactor.com>)
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <ext_safe_renegotiation.h>
+#include <gnutls_errors.h>
+
+int
+_gnutls_safe_renegotiation_recv_params (gnutls_session_t session, 
+		const opaque * data, size_t _data_size)
+{
+	tls_ext_st *ext = &session->security_parameters.extensions;
+	int len = data[0];
+	ssize_t data_size = _data_size;
+
+	DECR_LEN (data_size, len+1 /* count the first byte and payload */);
+
+	if (session->internals.priorities.sr == SR_DISABLED)
+	{
+		gnutls_assert ();
+		return 0;
+	}
+
+	/* It is not legal to receive this extension on a renegotiation and
+	 * not receive it on the initial negotiation.
+	 */
+	if (session->internals.initial_negotiation_completed != 0 &&
+			session->internals.connection_using_safe_renegotiation == 0)
+	{
+		gnutls_assert();
+		return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+	}
+
+	if (len > sizeof (ext->ri_extension_data))
+	{
+		gnutls_assert();
+		return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+	}
+
+	if (len > 0)
+		memcpy (ext->ri_extension_data, &data[1], len);
+	ext->ri_extension_data_len = len;
+
+	/* "safe renegotiation received" means on *this* handshake; "connection using
+	 * safe renegotiation" means that the initial hello received on the connection
+	 * indicated safe renegotiation. 
+	 */
+	session->internals.safe_renegotiation_received = 1;
+	session->internals.connection_using_safe_renegotiation = 1;
+
+	return 0;
+}
+
+int
+_gnutls_safe_renegotiation_send_params (gnutls_session_t session, 
+		opaque * data, size_t _data_size)
+{
+	/* The format of this extension is a one-byte length of verify data followed
+	 * by the verify data itself. Note that the length byte does not include
+	 * itself; IOW, empty verify data is represented as a length of 0. That means
+	 * the minimum extension is one byte: 0x00.
+	 */
+	ssize_t data_size = _data_size;
+	tls_ext_st *ext = &session->security_parameters.extensions;
+
+
+	if (session->internals.priorities.sr == SR_DISABLED)
+	{
+		gnutls_assert();
+		return 0;
+	}
+
+	data[0] = 0;
+
+	/* Always offer the extension if we're a client */
+	if (session->internals.connection_using_safe_renegotiation ||
+			session->security_parameters.entity == GNUTLS_CLIENT)
+	{
+		DECR_LEN (data_size, 1);
+		data[0] = ext->client_verify_data_len;
+
+		DECR_LEN (data_size, ext->client_verify_data_len);
+
+		if (ext->client_verify_data_len > 0)
+			memcpy(&data[1], 
+					ext->client_verify_data, 
+					ext->client_verify_data_len);
+
+		if (session->security_parameters.entity == GNUTLS_SERVER)
+		{
+			data[0] += ext->server_verify_data_len;
+
+			DECR_LEN (data_size, ext->server_verify_data_len);
+
+			if (ext->server_verify_data_len > 0)
+				memcpy(&data[1 + ext->client_verify_data_len],
+						ext->server_verify_data,
+						ext->server_verify_data_len);
+		}
+	}
+	else
+		return 0;
+
+	return 1 + data[0]; /* don't forget the length byte */
+}
+
+/**
+ * gnutls_safe_renegotiation_status:
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Can be used to check whether safe renegotiation is being used
+ * in the current session. Returns 0 when not and non zero when
+ * used.
+ **/
+int gnutls_safe_renegotiation_status (gnutls_session_t session)
+{
+	return session->internals.connection_using_safe_renegotiation;
+}
Index: gnutls-2.4.1/lib/ext_safe_renegotiation.h
===================================================================
--- /dev/null
+++ gnutls-2.4.1/lib/ext_safe_renegotiation.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2009 Free Software Foundation
+ *
+ * Author: Steve Dispensa (<dispensa@phonefactor.com>)
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef EXT_SAFE_RENEGOTIATION_H
+# define EXT_SAFE_RENEGOTIATION_H
+
+int _gnutls_safe_renegotiation_recv_params (gnutls_session_t state, 
+		const opaque * data, size_t data_size);
+int _gnutls_safe_renegotiation_send_params (gnutls_session_t state, 
+		opaque * data, size_t);
+
+#endif /* EXT_SAFE_RENEGOTIATION_H */
Index: gnutls-2.4.1/lib/gnutls_alert.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_alert.c
+++ gnutls-2.4.1/lib/gnutls_alert.c
@@ -179,6 +179,10 @@ gnutls_error_to_alert (int err, int *lev
       ret = GNUTLS_A_ILLEGAL_PARAMETER;
       _level = GNUTLS_AL_FATAL;
       break;
+    case GNUTLS_E_UNKNOWN_SRP_USERNAME:
+      ret = GNUTLS_A_UNKNOWN_PSK_IDENTITY;
+      _level = GNUTLS_AL_FATAL;
+      break;
     case GNUTLS_E_ASN1_ELEMENT_NOT_FOUND:
     case GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND:
     case GNUTLS_E_ASN1_DER_ERROR:
@@ -198,6 +202,7 @@ gnutls_error_to_alert (int err, int *lev
     case GNUTLS_E_INSUFFICIENT_CREDENTIALS:
     case GNUTLS_E_NO_CIPHER_SUITES:
     case GNUTLS_E_NO_COMPRESSION_ALGORITHMS:
+    case GNUTLS_E_SAFE_RENEGOTIATION_FAILED:
       ret = GNUTLS_A_HANDSHAKE_FAILURE;
       _level = GNUTLS_AL_FATAL;
       break;
@@ -211,6 +216,7 @@ gnutls_error_to_alert (int err, int *lev
       _level = GNUTLS_AL_FATAL;
       break;
     case GNUTLS_E_REHANDSHAKE:
+    case GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED:
       ret = GNUTLS_A_NO_RENEGOTIATION;
       _level = GNUTLS_AL_WARNING;
       break;
Index: gnutls-2.4.1/lib/gnutls_algorithms.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_algorithms.c
+++ gnutls-2.4.1/lib/gnutls_algorithms.c
@@ -472,6 +472,9 @@ typedef struct
 #define GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x45 }
 #define GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x88 }
 
+/* Safe renegotiation */
+#define GNUTLS_RENEGO_PROTECTION_REQUEST { GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR, GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR }
+
 #define CIPHER_SUITES_COUNT sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry)-1
 
 static const gnutls_cipher_suite_entry cs_algorithms[] = {
@@ -639,6 +642,9 @@ static const gnutls_cipher_suite_entry c
 			     GNUTLS_CIPHER_CAMELLIA_256_CBC, GNUTLS_KX_RSA,
 			     GNUTLS_MAC_SHA1, GNUTLS_TLS1),
 #endif
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RENEGO_PROTECTION_REQUEST,
+		             GNUTLS_CIPHER_UNKNOWN, GNUTLS_KX_UNKNOWN,
+		             GNUTLS_MAC_UNKNOWN, GNUTLS_SSL3),
   {0, {{0, 0}}, 0, 0, 0, 0}
 };
 
Index: gnutls-2.4.1/lib/gnutls_algorithms.h
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_algorithms.h
+++ gnutls-2.4.1/lib/gnutls_algorithms.h
@@ -27,6 +27,9 @@
 
 #include "gnutls_auth.h"
 
+#define GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR 0x00
+#define GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR 0xFF
+
 /* Functions for version handling. */
 gnutls_protocol_t _gnutls_version_lowest (gnutls_session_t session);
 gnutls_protocol_t _gnutls_version_max (gnutls_session_t session);
Index: gnutls-2.4.1/lib/gnutls_constate.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_constate.c
+++ gnutls-2.4.1/lib/gnutls_constate.c
@@ -426,6 +426,17 @@ _gnutls_set_write_keys (gnutls_session_t
 			   export_flag);
 }
 
+#define CPY_EXTENSIONS \
+	memcpy(dst->extensions.server_names, src->extensions.server_names, sizeof(src->extensions.server_names)); \
+	dst->extensions.server_names_size = src->extensions.server_names_size; \
+	memcpy(dst->extensions.srp_username, src->extensions.srp_username, sizeof(src->extensions.srp_username)); \
+	dst->extensions.gnutls_ia_enable = src->extensions.gnutls_ia_enable; \
+	dst->extensions.gnutls_ia_peer_enable = src->extensions.gnutls_ia_peer_enable; \
+	dst->extensions.gnutls_ia_allowskip = src->extensions.gnutls_ia_allowskip; \
+	dst->extensions.gnutls_ia_peer_allowskip = src->extensions.gnutls_ia_peer_allowskip; \
+	dst->extensions.do_recv_supplemental = src->extensions.do_recv_supplemental; \
+	dst->extensions.do_send_supplemental = src->extensions.do_send_supplemental
+		
 #define CPY_COMMON dst->entity = src->entity; \
 	dst->kx_algorithm = src->kx_algorithm; \
 	memcpy( &dst->current_cipher_suite, &src->current_cipher_suite, sizeof(cipher_suite_st)); \
@@ -439,8 +450,8 @@ _gnutls_set_write_keys (gnutls_session_t
 	dst->max_record_recv_size = src->max_record_recv_size; \
 	dst->max_record_send_size = src->max_record_send_size; \
 	dst->version = src->version; \
-	memcpy( &dst->extensions, &src->extensions, sizeof(tls_ext_st)); \
-	memcpy( &dst->inner_secret, &src->inner_secret, TLS_MASTER_SIZE);
+	CPY_EXTENSIONS; \
+	memcpy( &dst->inner_secret, &src->inner_secret, TLS_MASTER_SIZE)
 
 static void
 _gnutls_cpy_read_security_parameters (security_parameters_st *
Index: gnutls-2.4.1/lib/gnutls_errors.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_errors.c
+++ gnutls-2.4.1/lib/gnutls_errors.c
@@ -214,9 +214,15 @@ static const gnutls_error_entry error_al
 	       GNUTLS_E_OPENPGP_GETKEY_FAILED, 1),
   ERROR_ENTRY (N_("Could not find OpenPGP subkey."),
 	       GNUTLS_E_OPENPGP_SUBKEY_ERROR, 1),
+  ERROR_ENTRY (N_("Safe renegotiation failed."),
+		GNUTLS_E_SAFE_RENEGOTIATION_FAILED, 1),
+  ERROR_ENTRY (N_("Unsafe renegotiation denied."),
+		GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED, 1),
 
   ERROR_ENTRY (N_("The SRP username supplied is illegal."),
 	       GNUTLS_E_ILLEGAL_SRP_USERNAME, 1),
+  ERROR_ENTRY (N_("The SRP username supplied is unknown."),
+		 GNUTLS_E_UNKNOWN_SRP_USERNAME, 1),
 
   ERROR_ENTRY (N_("The OpenPGP fingerprint is not supported."),
 	       GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED, 1),
Index: gnutls-2.4.1/lib/gnutls_extensions.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_extensions.c
+++ gnutls-2.4.1/lib/gnutls_extensions.c
@@ -35,6 +35,7 @@
 #include <ext_server_name.h>
 #include <ext_oprfi.h>
 #include <ext_srp.h>
+#include <ext_safe_renegotiation.h>
 #include <ext_inner_application.h>
 #include <gnutls_num.h>
 
@@ -59,6 +60,10 @@ gnutls_extension_entry _gnutls_extension
                           EXTENSION_APPLICATION,
 			  _gnutls_server_name_recv_params,
 			  _gnutls_server_name_send_params),
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_SAFE_RENEGOTIATION,
+		          GNUTLS_EXT_MANDATORY,
+			  _gnutls_safe_renegotiation_recv_params,
+			  _gnutls_safe_renegotiation_send_params),
 #ifdef ENABLE_OPRFI
   GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_OPAQUE_PRF_INPUT,
                           EXTENSION_TLS,
@@ -174,7 +179,7 @@ _gnutls_parse_extensions (gnutls_session
       type = _gnutls_read_uint16 (&data[pos]);
       pos += 2;
 
-      _gnutls_debug_log ("EXT[%x]: Received extension '%s/%d'\n", session,
+      _gnutls_debug_log ("EXT[%p]: Found extension '%s/%d'\n", session,
 			 _gnutls_extension_get_name (type),type);
 
       if ((ret = _gnutls_extension_list_check (session, type)) < 0)
@@ -211,7 +216,7 @@ _gnutls_parse_extensions (gnutls_session
  * This list is used to check whether the (later) received
  * extensions are the ones we requested.
  */
-static void
+void
 _gnutls_extension_list_add (gnutls_session_t session, uint16_t type)
 {
 
@@ -232,7 +237,7 @@ _gnutls_extension_list_add (gnutls_sessi
 
 int
 _gnutls_gen_extensions (gnutls_session_t session, opaque * data,
-			size_t data_size)
+			size_t data_size, tls_ext_parse_type_t parse_type)
 {
   int size;
   uint16_t pos = 0;
@@ -263,6 +268,10 @@ _gnutls_gen_extensions (gnutls_session_t
       ext_send = _gnutls_ext_func_send (p->type);
       if (ext_send == NULL)
 	continue;
+       
+      if (parse_type != EXTENSION_ANY && p->parse_type != parse_type)
+        continue;
+
       size = ext_send (session, sdata, sdata_size);
       if (size > 0)
 	{
Index: gnutls-2.4.1/lib/gnutls_extensions.h
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_extensions.h
+++ gnutls-2.4.1/lib/gnutls_extensions.h
@@ -27,7 +27,7 @@
 const char *_gnutls_extension_get_name (uint16_t type);
 int _gnutls_parse_extensions (gnutls_session_t, tls_ext_parse_type_t, const opaque *, int);
 int _gnutls_gen_extensions (gnutls_session_t session, opaque * data,
-			    size_t data_size);
+                            size_t data_size, tls_ext_parse_type_t);
 
 typedef int (*ext_recv_func) (gnutls_session_t, const opaque *, size_t);	/* recv data */
 typedef int (*ext_send_func) (gnutls_session_t, opaque *, size_t);	/* send data */
@@ -43,3 +43,5 @@ typedef struct
   ext_recv_func gnutls_ext_func_recv;
   ext_send_func gnutls_ext_func_send;
 } gnutls_extension_entry;
+
+void _gnutls_extension_list_add (gnutls_session_t session, uint16_t type);
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -48,6 +48,7 @@
 #include <gnutls_record.h>
 #include <gnutls_state.h>
 #include <ext_srp.h>
+#include <ext_safe_renegotiation.h>
 #include <gnutls_rsa_export.h>	/* for gnutls_get_rsa_params() */
 #include <auth_anon.h>		/* for gnutls_anon_server_credentials_t */
 #include <auth_psk.h>		/* for gnutls_psk_server_credentials_t */
@@ -396,6 +397,33 @@ _gnutls_read_client_hello (gnutls_sessio
 
   if (ret == 0)
     {				/* resumed! */
+	    /* Parse only the safe renegotiation extension
+	     * We don't want to parse any other extensions since
+	     * we don't want new extension values to overwrite the
+	     * resumed ones.
+	     */
+
+	    /* move forward to extensions */
+	    DECR_LEN (len, 2);
+	    suite_size = _gnutls_read_uint16 (&data[pos]);
+	    pos += 2;
+
+	    DECR_LEN (len, suite_size);
+	    pos += suite_size;
+
+	    DECR_LEN (len, 1);
+	    comp_size = data[pos++]; /* z is the number of compression methods */
+	    DECR_LEN (len, comp_size);
+	    pos += comp_size;
+
+	    ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY,
+			    &data[pos], len);
+	    if (ret < 0)
+	    {
+		    gnutls_assert ();
+		    return ret;
+	    }
+
       resume_copy_required_values (session);
       session->internals.resumed = RESUME_TRUE;
       return _gnutls_user_hello_func( session, adv_version);
@@ -430,16 +458,18 @@ _gnutls_read_client_hello (gnutls_sessio
   pos += comp_size;
 
   /* Parse the extensions (if any)
-   */
-  if (neg_version >= GNUTLS_TLS1)
-    {
-      ret = _gnutls_parse_extensions (session, EXTENSION_APPLICATION, &data[pos], len);	/* len is the rest of the parsed length */
-      if (ret < 0)
-	{
+   *
+   * Unconditionally try to parse extensions; safe renegotiation uses them in
+   * sslv3 and higher, even though sslv3 doesn't officially support them.
+   */
+  ret = _gnutls_parse_extensions (session, EXTENSION_APPLICATION,
+		  &data[pos], len);
+  /* len is the rest of the parsed length */
+  if (ret < 0)
+  {
 	  gnutls_assert ();
 	  return ret;
-	}
-    }
+  }
 
   ret = _gnutls_user_hello_func( session, adv_version);
   if (ret < 0) 
@@ -448,15 +478,20 @@ _gnutls_read_client_hello (gnutls_sessio
       return ret;
     }
   
-  if (neg_version >= GNUTLS_TLS1)
-    {
-      ret = _gnutls_parse_extensions (session, EXTENSION_TLS, &data[pos], len);	/* len is the rest of the parsed length */
-      if (ret < 0)
-	{
+  ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY,
+		  &data[pos], len);
+  if (ret < 0)
+  {
 	  gnutls_assert ();
 	  return ret;
-	}
-    }
+  }
+  ret = _gnutls_parse_extensions (session, EXTENSION_TLS,
+		  &data[pos], len);
+  if (ret < 0)
+  {
+	  gnutls_assert ();
+	  return ret;
+  }
 
   /* select an appropriate cipher suite
    */
@@ -520,7 +555,7 @@ _gnutls_handshake_hash_pending (gnutls_s
 int
 _gnutls_send_finished (gnutls_session_t session, int again)
 {
-  uint8_t data[36];
+  uint8_t data[MAX_VERIFY_DATA_SIZE];
   int ret;
   int data_size = 0;
 
@@ -560,6 +595,31 @@ _gnutls_send_finished (gnutls_session_t
 
     }
 
+  /* Save data for safe renegotiation. 
+  */
+  if (data_size > MAX_VERIFY_DATA_SIZE) 
+  {
+	  gnutls_assert ();
+	  return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+  }
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+  {
+	  session->security_parameters.extensions.client_verify_data_len = 
+		  data_size;
+
+	  memcpy (session->security_parameters.extensions.client_verify_data,
+			  data, data_size);
+  }
+  else
+  {
+	  session->security_parameters.extensions.server_verify_data_len = 
+		  data_size;
+
+	  memcpy (session->security_parameters.extensions.server_verify_data,
+			  data, data_size);
+  }
+
   ret =
     _gnutls_send_handshake (session, data, data_size,
 			    GNUTLS_HANDSHAKE_FINISHED);
@@ -573,10 +633,11 @@ _gnutls_send_finished (gnutls_session_t
 int
 _gnutls_recv_finished (gnutls_session_t session)
 {
-  uint8_t data[36], *vrfy;
+  uint8_t data[MAX_VERIFY_DATA_SIZE], *vrfy;
   int data_size;
   int ret;
   int vrfysize;
+  tls_ext_st *ext;
 
   ret =
     _gnutls_recv_handshake (session, &vrfy, &vrfysize,
@@ -634,6 +695,28 @@ _gnutls_recv_finished (gnutls_session_t
     }
   gnutls_free (vrfy);
 
+  /* Save peer's verify data for safe renegotiation */
+  if (data_size > MAX_VERIFY_DATA_SIZE)
+  {
+	  gnutls_assert ();
+	  return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+  }
+
+  ext = &session->security_parameters.extensions;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+  {
+	  memcpy (ext->server_verify_data, data, data_size);
+	  ext->server_verify_data_len = data_size;
+  }
+  else
+  {
+	  memcpy (ext->client_verify_data, data, data_size);
+	  ext->client_verify_data_len = data_size;
+  }
+
+  session->internals.initial_negotiation_completed = 1;
+
   return ret;
 }
 
@@ -688,6 +771,26 @@ _gnutls_server_select_suite (gnutls_sess
 					 * supported by the peer.
 					 */
 
+  /* First, check for safe renegotiation SCSV.
+  */
+  if (session->internals.priorities.sr != SR_DISABLED) 
+  {
+	  int offset;
+
+	  for(offset = 0; offset < datalen; offset += 2)
+	  {
+		  /* TLS_RENEGO_PROTECTION_REQUEST = { 0x00, 0xff } */
+		  if (data[offset]   == GNUTLS_RENEGO_PROTECTION_REQUEST_MAJOR &&
+				  data[offset+1] == GNUTLS_RENEGO_PROTECTION_REQUEST_MINOR)
+		  {
+			  _gnutls_handshake_log ("HSK[%p]: Received safe renegotiation CS\n", session);
+			  session->internals.safe_renegotiation_received = 1;
+			  session->internals.connection_using_safe_renegotiation = 1;
+			  break;
+		  }
+	  }
+  }
+
   pk_algo = _gnutls_server_find_pk_algos_in_ciphersuites (data, datalen);
 
   x = _gnutls_supported_ciphersuites (session, &ciphers);
@@ -1029,7 +1132,6 @@ _gnutls_recv_handshake_header (gnutls_se
 
       if (ret < 0)
 	{
-	  gnutls_assert ();
 	  return ret;
 	}
 
@@ -1520,8 +1622,21 @@ _gnutls_read_server_hello (gnutls_sessio
    * values;
    */
   if (_gnutls_client_check_if_resuming
-      (session, &data[pos], session_id_len) == 0)
-    return 0;
+		  (session, &data[pos], session_id_len) == 0)
+  {
+	  pos += session_id_len + 2 + 1;
+	  DECR_LEN (len, 2+1);
+
+	  ret = _gnutls_parse_extensions (session, GNUTLS_EXT_MANDATORY,
+			  &data[pos], len);
+	  if (ret < 0)
+	  {
+		  gnutls_assert ();
+		  return ret;
+	  }
+	  return 0;
+  }
+
   pos += session_id_len;
 
 
@@ -1553,30 +1668,31 @@ _gnutls_read_server_hello (gnutls_sessio
 
   /* Parse extensions.
    */
-  if (version >= GNUTLS_TLS1)
-    {
-      ret = _gnutls_parse_extensions (session, EXTENSION_ANY, &data[pos], len);	/* len is the rest of the parsed length */
-      if (ret < 0)
-	{
+  ret = _gnutls_parse_extensions (session, EXTENSION_ANY,
+		  &data[pos], len);
+  if (ret < 0)
+  {
 	  gnutls_assert ();
 	  return ret;
-	}
-    }
+  }
   return ret;
 }
 
 
 /* This function copies the appropriate ciphersuites to a locally allocated buffer
- * Needed in client hello messages. Returns the new data length.
+ * Needed in client hello messages. Returns the new data length,If add_scsv is
+ * true, add the special safe renegotiation CS.
  */
 static int
 _gnutls_copy_ciphersuites (gnutls_session_t session,
-			   opaque * ret_data, size_t ret_data_size)
+		opaque * ret_data, size_t ret_data_size,
+		int add_scsv)
 {
   int ret, i;
   cipher_suite_st *cipher_suites;
   uint16_t cipher_num;
   int datalen, pos;
+  uint16_t loop_max;
 
   ret = _gnutls_supported_ciphersuites_sorted (session, &cipher_suites);
   if (ret < 0)
@@ -1607,6 +1723,9 @@ _gnutls_copy_ciphersuites (gnutls_sessio
       return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
     }
 
+  if (add_scsv)
+      ++ret;
+  
   cipher_num = ret;
 
   cipher_num *= sizeof (uint16_t);	/* in order to get bytes */
@@ -1624,11 +1743,21 @@ _gnutls_copy_ciphersuites (gnutls_sessio
   _gnutls_write_uint16 (cipher_num, ret_data);
   pos += 2;
 
-  for (i = 0; i < (cipher_num / 2); i++)
+  loop_max = add_scsv ? cipher_num - 2 : cipher_num;
+
+  for (i = 0; i < (loop_max / 2); i++)
     {
       memcpy (&ret_data[pos], cipher_suites[i].suite, 2);
       pos += 2;
     }
+
+  if (add_scsv)
+  {
+	  /* Safe renegotiation signalling CS value is { 0x00, 0xff } */
+	  ret_data[pos++] = 0x00;
+	  ret_data[pos++] = 0xff;
+  }
+
   gnutls_free (cipher_suites);
 
   return datalen;
@@ -1688,7 +1817,7 @@ _gnutls_send_client_hello (gnutls_sessio
 {
   opaque *data = NULL;
   int extdatalen;
-  int pos = 0;
+  int pos = 0, type;
   int datalen = 0, ret = 0;
   opaque rnd[TLS_RANDOM_SIZE];
   gnutls_protocol_t hver;
@@ -1777,9 +1906,21 @@ _gnutls_send_client_hello (gnutls_sessio
 
 
       /* Copy the ciphersuites.
+       *
+       * If using SSLv3 Send TLS_RENEGO_PROTECTION_REQUEST SCSV for MITM
+       * prevention on initial negotiation (but not renegotiation; that's
+       * handled with the RI extension below).
        */
-      extdatalen =
-	_gnutls_copy_ciphersuites (session, extdata, sizeof (extdata));
+      if(!session->internals.initial_negotiation_completed &&
+		      session->security_parameters.entity == GNUTLS_CLIENT &&
+		      gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+      {
+	      extdatalen = _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata), TRUE);
+	      _gnutls_extension_list_add (session, GNUTLS_EXTENSION_SAFE_RENEGOTIATION);
+      }
+      else
+	      extdatalen = _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata), FALSE);
+
       if (extdatalen > 0)
 	{
 	  datalen += extdatalen;
@@ -1834,9 +1975,17 @@ _gnutls_send_client_hello (gnutls_sessio
       /* Generate and copy TLS extensions.
        */
       if (hver >= GNUTLS_TLS1)
-	{
-	  extdatalen =
-	    _gnutls_gen_extensions (session, extdata, sizeof (extdata));
+	      type = EXTENSION_ANY;
+      else
+      {
+	      if (session->internals.initial_negotiation_completed != 0)
+		      type = GNUTLS_EXT_MANDATORY;
+	      else
+		      type = GNUTLS_EXT_NONE;
+      }
+
+      extdatalen =
+	      _gnutls_gen_extensions (session, extdata, sizeof (extdata), type);
 
 	  if (extdatalen > 0)
 	    {
@@ -1856,7 +2005,6 @@ _gnutls_send_client_hello (gnutls_sessio
 	      gnutls_free (data);
 	      return extdatalen;
 	    }
-	}
     }
 
   ret =
@@ -1902,15 +2050,7 @@ _gnutls_send_server_hello (gnutls_sessio
 	   * alert and abort.
 	   */
 	  gnutls_assert ();
-	  ret = gnutls_alert_send (session, GNUTLS_AL_FATAL,
-				   GNUTLS_A_UNKNOWN_PSK_IDENTITY);
-	  if (ret < 0)
-	    {
-	      gnutls_assert ();
-	      return ret;
-	    }
-
-	  return GNUTLS_E_ILLEGAL_SRP_USERNAME;
+	  return GNUTLS_E_UNKNOWN_SRP_USERNAME;
 	}
     }
 #endif
@@ -1919,7 +2059,7 @@ _gnutls_send_server_hello (gnutls_sessio
     {
       datalen = 2 + session_id_len + 1 + TLS_RANDOM_SIZE + 3;
       extdatalen =
-	_gnutls_gen_extensions (session, extdata, sizeof (extdata));
+         _gnutls_gen_extensions (session, extdata, sizeof (extdata), EXTENSION_ANY);
 
       if (extdatalen < 0)
 	{
@@ -1985,6 +2125,8 @@ _gnutls_send_hello (gnutls_session_t ses
 {
   int ret;
 
+  session->internals.safe_renegotiation_received = 0;
+  
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
       ret = _gnutls_send_client_hello (session, again);
@@ -2006,6 +2148,7 @@ int
 _gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen)
 {
   int ret;
+  tls_ext_st *ext;
 
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
@@ -2027,6 +2170,89 @@ _gnutls_recv_hello (gnutls_session_t ses
 	}
     }
 
+  if (session->internals.priorities.sr == SR_DISABLED)
+  {
+	  gnutls_assert();
+	  return ret;
+  }
+
+  /* Safe renegotiation */
+  ext = &session->security_parameters.extensions;
+
+  if (session->internals.safe_renegotiation_received)
+  {
+	  if ((ext->ri_extension_data_len < ext->client_verify_data_len) ||
+			  (memcmp (ext->ri_extension_data,
+				   ext->client_verify_data,
+				   ext->client_verify_data_len)))
+	  {
+		  gnutls_assert();
+		  _gnutls_handshake_log ("Safe renegotiation failed [1]\n");
+		  return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+	  }
+	  if (session->security_parameters.entity == GNUTLS_CLIENT)
+	  {
+		  if ((ext->ri_extension_data_len !=
+					  ext->client_verify_data_len + ext->server_verify_data_len) ||
+				  memcmp (ext->ri_extension_data + ext->client_verify_data_len,
+					  ext->server_verify_data, ext->server_verify_data_len) != 0)
+		  {
+			  gnutls_assert();
+			  _gnutls_handshake_log ("Safe renegotiation failed [2]\n");
+			  return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+		  }
+	  }
+	  else /* Make sure there are 0 extra bytes */
+	  {
+		  if (ext->ri_extension_data_len != ext->client_verify_data_len)
+		  {
+			  gnutls_assert();
+			  _gnutls_handshake_log ("Safe renegotiation failed [3]\n");
+			  return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+		  }
+	  }
+
+	  _gnutls_handshake_log ("Safe renegotiation succeeded.\n");
+  }
+  else /* safe renegotiation not received... */
+  {
+	  if (session->internals.connection_using_safe_renegotiation)
+	  {
+		  gnutls_assert();
+		  _gnutls_handshake_log ("Peer previously asked for safe renegotiation!\n");
+		  return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+	  }
+
+	  /* Clients can't tell if it's an initial negotiation */
+	  if (session->internals.initial_negotiation_completed)
+	  {
+
+		  if (session->internals.priorities.sr < SR_PARTIAL)
+		  {
+			  _gnutls_handshake_log ("Allowing unsafe (re)negotiation!\n");
+		  }
+		  else
+		  {
+			  gnutls_assert();
+			  _gnutls_handshake_log ("Denying unsafe (re)negotiation.\n");
+			  return GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED;
+		  }
+	  }
+	  else
+	  {
+		  if (session->internals.priorities.sr < SR_SAFE)
+		  {
+			  _gnutls_handshake_log ("Allowing unsafe initial negotiation!\n");
+		  }
+		  else
+		  {
+			  gnutls_assert();
+			  _gnutls_handshake_log ("Denying unsafe initial negotiation.\n");
+			  return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+		  }
+	  }
+  }
+
   return ret;
 }
 
@@ -2067,6 +2293,13 @@ _gnutls_recv_hello (gnutls_session_t ses
   * gnutls_handshake() function in order to negotiate the new
   * parameters.
   *
+  * Since TLS is full duplex some application data might have been
+  * sent during peer's processing of this message. In that case
+  * one should call gnutls_record_recv() until GNUTLS_E_REHANDSHAKE
+  * is returned to clear any pending data. Care must be taken if
+  * rehandshake is mandatory to terminate if it does not start after
+  * some threshold.
+  *
   * If the client does not wish to renegotiate parameters he will
   * should with an alert message, thus the return code will be
   * %GNUTLS_E_WARNING_ALERT_RECEIVED and the alert will be
Index: gnutls-2.4.1/lib/gnutls_int.h
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_int.h
+++ gnutls-2.4.1/lib/gnutls_int.h
@@ -142,7 +142,8 @@ typedef enum extensions_t
   GNUTLS_EXTENSION_OPAQUE_PRF_INPUT = ENABLE_OPRFI,
 #endif
   GNUTLS_EXTENSION_SRP = 12,
-  GNUTLS_EXTENSION_INNER_APPLICATION = 37703
+  GNUTLS_EXTENSION_INNER_APPLICATION = 37703,
+  GNUTLS_EXTENSION_SAFE_RENEGOTIATION = 65281, /* aka: 0xff01 */
 } extensions_t;
 
 typedef enum
@@ -257,6 +258,11 @@ typedef struct
 } server_name_st;
 
 #define MAX_SERVER_NAME_EXTENSIONS 3
+#define MAX_VERIFY_DATA_SIZE 36 /* in SSL 3.0, 12 in TLS 1.0 */
+
+/* If you want the extension data to be kept across resuming sessions
+ * then modify CPY_EXTENSIONS in gnutls_constate.c
+ */
 
 typedef struct
 {
@@ -273,6 +279,9 @@ typedef struct
   /* Used by extensions that enable supplemental data. */
   int do_recv_supplemental, do_send_supplemental;
 
+  /*** Those below do not get copied when resuming session 
+   ***/
+
   /* Opaque PRF input. */
   gnutls_oprfi_callback_func oprfi_cb;
   void *oprfi_userdata;
@@ -280,6 +289,15 @@ typedef struct
   uint16_t oprfi_client_len;
   opaque *oprfi_server;
   uint16_t oprfi_server_len;
+
+  /* Safe renegotiation. */
+  uint8_t client_verify_data[MAX_VERIFY_DATA_SIZE];
+  size_t client_verify_data_len;
+  uint8_t server_verify_data[MAX_VERIFY_DATA_SIZE];
+  size_t server_verify_data_len;
+  uint8_t ri_extension_data[MAX_VERIFY_DATA_SIZE*2]; /* max signal is 72 bytes in s->c sslv3 */
+  size_t ri_extension_data_len;
+
 } tls_ext_st;
 
 /* This flag indicates for an extension whether
@@ -291,7 +309,9 @@ typedef enum tls_ext_parse_type_t
 {
   EXTENSION_ANY,
   EXTENSION_APPLICATION,
-  EXTENSION_TLS
+  EXTENSION_TLS,
+  GNUTLS_EXT_MANDATORY, /* parse even if resuming or extensions disabled */
+  GNUTLS_EXT_NONE,
 } tls_ext_parse_type_t;
 
 /* auth_info_t structures now MAY contain malloced 
@@ -388,6 +408,13 @@ typedef struct
   unsigned int algorithms;
 } priority_st;
 
+typedef enum {
+	SR_DISABLED,
+	SR_UNSAFE,
+	SR_PARTIAL,
+	SR_SAFE,
+} safe_renegotiation_t;
+
 /* For the external api */
 struct gnutls_priority_st
 {
@@ -399,7 +426,8 @@ struct gnutls_priority_st
   priority_st cert_type;
 
   /* to disable record padding */
-  int no_padding;
+  int no_padding:1;
+  safe_renegotiation_t sr;
 };
 
 
@@ -651,6 +679,10 @@ typedef struct
   gnutls_sign_func sign_func;
   void *sign_func_userdata;
 
+  int safe_renegotiation_received:1;
+  int initial_negotiation_completed:1;
+  int connection_using_safe_renegotiation:1;
+
   /* If you add anything here, check _gnutls_handshake_internal_state_clear().
    */
 } internals_st;
Index: gnutls-2.4.1/lib/gnutls_priority.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_priority.c
+++ gnutls-2.4.1/lib/gnutls_priority.c
@@ -473,6 +473,22 @@ gnutls_priority_set (gnutls_session_t se
   * '+' appended with an algorithm will add this algorithm.
   * '%COMPAT' will enable compatibility features for a server.
   *
+  * "%DISABLE_SAFE_RENEGOTIATION" will disable safe renegotiation completely. Do not use
+  * unless you know what you are doing. Testing purposes only.
+  *
+  * "%UNSAFE_RENEGOTIATION" will allow unsafe renegotiation (this is now
+  * the default for clients, but will change once more servers support the safe renegotiation
+  * TLS fix).
+  *
+  * "%PARTIAL_SAFE_RENEGOTIATION" In server side it will enable safe renegotiation
+  * and will protect all clients from known attacks, but will not prevent insecure clients
+  * from connecting. In client side it will disallow from renegotiating with an insecure server
+  * but will not prevent connecting to one (this leaves the client vulnerable to attacks).
+  *
+  * "%SAFE_RENEGOTIATION" will enforce safe renegotiation. Clients and Servers will refuse
+  * to talk to an insecure peer.
+  *
+  *
   * To avoid collisions in order to specify a compression algorithm in
   * this string you have to prefix it with "COMP-", protocol versions
   * with "VERS-" and certificate types with "CTYPE-". All other
@@ -502,7 +518,7 @@ gnutls_priority_init (gnutls_priority_t
 {
   char *broken_list[MAX_ELEMENTS];
   int broken_list_size, i, j;
-  char *darg;
+  char *darg = NULL;
   int algo;
   rmadd_func *fn;
 
@@ -512,6 +528,11 @@ gnutls_priority_init (gnutls_priority_t
       gnutls_assert ();
       return GNUTLS_E_MEMORY_ERROR;
     }
+  
+  /* for now unsafe renegotiation is default on everyone. To be removed
+   * when we make it the default.
+   */
+  (*priority_cache)->sr = SR_PARTIAL;
 
   if (priorities == NULL)
     priorities = "NORMAL";
@@ -520,7 +541,7 @@ gnutls_priority_init (gnutls_priority_t
   if (darg == NULL)
     {
       gnutls_assert ();
-      return GNUTLS_E_MEMORY_ERROR;
+      goto error;
     }
 
   break_comma_list (darg, broken_list, &broken_list_size, MAX_ELEMENTS, ':');
@@ -610,6 +631,25 @@ gnutls_priority_init (gnutls_priority_t
 		  GNUTLS_CRT_UNKNOWN)
 		fn (&(*priority_cache)->cert_type, algo);
 	    }			/* now check if the element is something like -ALGO */
+	  else if (strcasecmp (&broken_list[i][1],
+				  "UNSAFE_RENEGOTIATION") == 0)
+	  {
+		  (*priority_cache)->sr = SR_UNSAFE;
+	  }
+	  else if (strcasecmp (&broken_list[i][1], "SAFE_RENEGOTIATION") == 0)
+	  {
+		  (*priority_cache)->sr = SR_SAFE;
+	  }
+	  else if (strcasecmp (&broken_list[i][1],
+				  "PARTIAL_RENEGOTIATION") == 0)
+	  {
+		  (*priority_cache)->sr = SR_PARTIAL;
+	  }
+	  else if (strcasecmp (&broken_list[i][1],
+				  "DISABLE_SAFE_RENEGOTIATION") == 0)
+	  {
+		  (*priority_cache)->sr = SR_DISABLED;
+	  }
 	  else
 	    goto error;
 	}
@@ -637,6 +677,7 @@ error:
 	}
     }
   gnutls_free (darg);
+  gnutls_free(*priority_cache);
 
   return GNUTLS_E_INVALID_REQUEST;
 
Index: gnutls-2.4.1/lib/gnutls_record.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_record.c
+++ gnutls-2.4.1/lib/gnutls_record.c
@@ -741,10 +741,18 @@ record_check_type (gnutls_session_t sess
 	   * If we are a server, a client may initiate a renegotiation at any time.
 	   */
 	  if (session->security_parameters.entity == GNUTLS_SERVER)
-	    {
-	      gnutls_assert ();
-	      return GNUTLS_E_REHANDSHAKE;
-	    }
+	  {
+		  gnutls_assert ();
+		  ret =
+			  _gnutls_record_buffer_put (recv_type, session, (void *) data,
+					  data_size);
+		  if (ret < 0)
+		  {
+			  gnutls_assert ();
+			  return ret;
+		  }
+		  return GNUTLS_E_REHANDSHAKE;
+	  }
 
 	  /* If we are already in a handshake then a Hello
 	   * Request is illegal. But here we don't really care
@@ -896,9 +904,13 @@ begin:
        _gnutls_io_read_buffered (session, &headers, header_size,
 				 -1)) != header_size)
     {
+      _gnutls_handshake_log ("XXX[]: ret: %d %s\n", ret, gnutls_strerror(ret));
+
       if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
 	return ret;
 
+      _gnutls_handshake_log ("XXX2[]: ret: %d %s\n", ret, gnutls_strerror(ret));
+
       session_invalidate (session);
       if (type == GNUTLS_ALERT)
 	{
Index: gnutls-2.4.1/lib/gnutls_state.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_state.c
+++ gnutls-2.4.1/lib/gnutls_state.c
@@ -214,6 +214,7 @@ _gnutls_handshake_internal_state_clear (
   session->internals.adv_version_minor = 0;
   session->internals.adv_version_minor = 0;
   session->internals.direction = 0;
+  session->internals.safe_renegotiation_received = 0;
 
   /* use out of band data for the last
    * handshake messages received.
@@ -330,6 +331,11 @@ gnutls_init (gnutls_session_t * session,
 
   _gnutls_handshake_internal_state_clear (*session);
 
+  /* emulate old gnutls behavior for old applications that do not use the priority_*
+   * functions.
+   */
+  (*session)->internals.priorities.sr = SR_PARTIAL;
+
   return 0;
 }
 
Index: gnutls-2.4.1/src/cli-gaa.c
===================================================================
--- gnutls-2.4.1.orig/src/cli-gaa.c
+++ gnutls-2.4.1/src/cli-gaa.c
@@ -129,6 +129,7 @@ void gaa_help(void)
 	printf("GNU TLS test client\nUsage:  gnutls-cli [options] hostname\n\n\n");
 	__gaa_helpsingle('d', "debug", "integer ", "Enable debugging");
 	__gaa_helpsingle('r', "resume", "", "Connect, establish a session. Connect again and resume this session.");
+	__gaa_helpsingle('e', "rehandshake", "", "Connect, establish a session and rehandshake immediately.");
 	__gaa_helpsingle('s', "starttls", "", "Connect, establish a plain session and start TLS when EOF or a SIGALRM is received.");
 	__gaa_helpsingle(0, "crlf", "", "Send CR LF instead of LF.");
 	__gaa_helpsingle(0, "x509fmtder", "", "Use DER format for certificates to read from.");
@@ -251,6 +252,8 @@ struct _gaainfo
 	int crlf;
 #line 20 "cli.gaa"
 	int starttls;
+#line 20 "cli.gaa"
+	int rehandshake;
 #line 17 "cli.gaa"
 	int resume;
 #line 14 "cli.gaa"
@@ -309,7 +312,7 @@ static int gaa_error = 0;
 #define GAA_MULTIPLE_OPTION     3
 
 #define GAA_REST                0
-#define GAA_NB_OPTION           36
+#define GAA_NB_OPTION           37
 #define GAAOPTID_copyright	1
 #define GAAOPTID_version	2
 #define GAAOPTID_help	3
@@ -344,8 +347,9 @@ static int gaa_error = 0;
 #define GAAOPTID_x509fmtder	32
 #define GAAOPTID_crlf	33
 #define GAAOPTID_starttls	34
-#define GAAOPTID_resume	35
-#define GAAOPTID_debug	36
+#define GAAOPTID_rehandshake    35
+#define GAAOPTID_resume	36
+#define GAAOPTID_debug	37
 
 #line 168 "gaa.skel"
 
@@ -743,6 +747,7 @@ static int gaa_get_option_num(char *str,
 			GAA_CHECK1STR("", GAAOPTID_x509fmtder);
 			GAA_CHECK1STR("", GAAOPTID_crlf);
 			GAA_CHECK1STR("s", GAAOPTID_starttls);
+			GAA_CHECK1STR("e", GAAOPTID_rehandshake);
 			GAA_CHECK1STR("r", GAAOPTID_resume);
 
 #line 277 "gaa.skel"
@@ -782,6 +787,7 @@ static int gaa_get_option_num(char *str,
 			GAA_CHECKSTR("x509fmtder", GAAOPTID_x509fmtder);
 			GAA_CHECKSTR("crlf", GAAOPTID_crlf);
 			GAA_CHECKSTR("starttls", GAAOPTID_starttls);
+			GAA_CHECKSTR("rehandshake", GAAOPTID_rehandshake);
 			GAA_CHECKSTR("resume", GAAOPTID_resume);
 			GAA_CHECKSTR("debug", GAAOPTID_debug);
 
@@ -1131,6 +1137,13 @@ static int gaa_try(int gaa_num, int gaa_
 
 		return GAA_OK;
 		break;
+       case GAAOPTID_rehandshake:
+       OK = 0;
+#line 21 "cli.gaa"
+{ gaaval->rehandshake = 1 ;};
+
+               return GAA_OK;
+               break;
 	case GAAOPTID_resume:
 	OK = 0;
 #line 18 "cli.gaa"
@@ -1191,7 +1204,7 @@ int gaa(int argc, char **argv, gaainfo *
 	gaaval->srp_username=NULL; gaaval->srp_passwd=NULL; gaaval->fmtder = 0; gaaval->starttls =0; 
 	gaaval->debug = 0; gaaval->print_cert = 0; gaaval->verbose = 0; gaaval->psk_key = NULL; 
 	gaaval->psk_username = NULL; gaaval->priorities = NULL;
-	gaaval->opaque_prf_input = NULL; gaaval->pgp_subkey = NULL; ;};
+	gaaval->opaque_prf_input = NULL; gaaval->pgp_subkey = NULL; gaaval->rehandshake = 0; ;};
 
     }
     inited = 1;
Index: gnutls-2.4.1/src/cli-gaa.h
===================================================================
--- gnutls-2.4.1.orig/src/cli-gaa.h
+++ gnutls-2.4.1/src/cli-gaa.h
@@ -82,6 +82,7 @@ struct _gaainfo
 	int crlf;
 #line 20 "cli.gaa"
 	int starttls;
+	int rehandshake;
 #line 17 "cli.gaa"
 	int resume;
 #line 14 "cli.gaa"
Index: gnutls-2.4.1/src/cli.c
===================================================================
--- gnutls-2.4.1.orig/src/cli.c
+++ gnutls-2.4.1/src/cli.c
@@ -55,7 +55,7 @@ int _win_select(int max_fd, fd_set * rfd
 #define MAX_BUF 4096
 
 /* global stuff here */
-int resume, starttls, insecure;
+int resume, starttls, insecure, rehandshake;
 char *hostname = NULL;
 char *service;
 int record_max_size;
@@ -672,6 +672,23 @@ after_handshake:
      programs to search for when gnutls-cli has reached this point. */
   printf ("\n- Simple Client Mode:\n\n");
 
+  if (rehandshake)
+  {
+	  ret = do_handshake (&hd);
+
+	  if (ret < 0)
+	  {
+		  fprintf (stderr, "*** ReHandshake has failed\n");
+		  gnutls_perror (ret);
+		  gnutls_deinit (hd.session);
+		  return 1;
+	  }
+	  else
+	  {
+		  printf ("- ReHandshake was completed\n");
+	  }
+  }
+						
 #ifndef _WIN32
   signal (SIGALRM, &starttls_alarm);
 #endif
@@ -833,6 +850,7 @@ gaa_parser (int argc, char **argv)
   print_cert = info.print_cert;
   starttls = info.starttls;
   resume = info.resume;
+  rehandshake = info.rehandshake;
   insecure = info.insecure;
   service = info.port;
   record_max_size = info.record_size;
@@ -953,6 +971,11 @@ do_handshake (socket_st * socket)
       socket->secure = 1;
 
     }
+  else
+  {
+	  gnutls_alert_send_appropriate(socket->session, ret);
+	  shutdown (socket->fd, SHUT_RDWR);
+  }
   return ret;
 }
 
Index: gnutls-2.4.1/src/cli.gaa
===================================================================
--- gnutls-2.4.1.orig/src/cli.gaa
+++ gnutls-2.4.1/src/cli.gaa
@@ -17,6 +17,9 @@ option (d, debug) INT "integer" { $debug
 #int resume;
 option (r, resume) { $resume = 1 } "Connect, establish a session. Connect again and resume this session."
 
+#int rehandshake;
+option (e, rehandshake) { $rehandshake = 1 } "Connect, establish a session and rehandshake immediately."
+
 #int starttls;
 option (s, starttls) { $starttls = 1 } "Connect, establish a plain session and start TLS when EOF or a SIGALRM is received."
 
@@ -131,4 +134,4 @@ init { $resume=0; $port="443"; $rest_arg
 	$srp_username=NULL; $srp_passwd=NULL; $fmtder = 0; $starttls =0; 
 	$debug = 0; $print_cert = 0; $verbose = 0; $psk_key = NULL; 
 	$psk_username = NULL; $priorities = NULL;
-	$opaque_prf_input = NULL; $pgp_subkey = NULL; }
+	$opaque_prf_input = NULL; $pgp_subkey = NULL; $rehandshake = 0; }
Index: gnutls-2.4.1/src/serv.c
===================================================================
--- gnutls-2.4.1.orig/src/serv.c
+++ gnutls-2.4.1/src/serv.c
@@ -730,6 +730,18 @@ get_response (gnutls_session_t session,
     }
   else
     {
+	    fprintf(stderr, "received: %s\n", request);
+	    if (request[0] == request[1] && request[0] == '*')
+	    {
+		    if (strncmp(request, "**REHANDSHAKE**", sizeof("**REHANDSHAKE**")-1)==0)
+		    {
+			    fprintf(stderr, "*** Sending rehandshake request\n");
+			    gnutls_rehandshake(session);
+		    }
+		    *response = NULL;
+		    *response_length = 0;
+		    return;
+	    }
       *response = strdup (request);
       *response_length = ((*response) ? strlen (*response) : 0);
     }
@@ -1139,7 +1151,7 @@ main (int argc, char **argv)
 			ret =
 			  gnutls_alert_send_appropriate (j->tls_session, r);
 		      }
-		    while (ret == GNUTLS_E_AGAIN);
+		    while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
 		    j->http_state = HTTP_STATE_CLOSING;
 		  }
 		else if (r == 0)
@@ -1170,14 +1182,37 @@ main (int argc, char **argv)
 		  }
 		else if (r <= 0)
 		  {
-		    j->http_state = HTTP_STATE_CLOSING;
-		    if (r < 0 && r != GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
+	            if (r == GNUTLS_E_REHANDSHAKE)
 		      {
-			check_alert (j->tls_session, r);
-			fprintf (stderr, "Error while receiving data\n");
-			GERR (r);
+			      fprintf(stderr, "*** Received hello message\n");
+			      do 
+			      {
+				      r = gnutls_handshake (j->tls_session);
+			      } 
+			      while (r == GNUTLS_E_INTERRUPTED || r == GNUTLS_E_AGAIN);
+			      if (r < 0) 
+			      {
+
+				      do
+				      {
+					      ret = gnutls_alert_send_appropriate (j->tls_session, r);
+				      }
+				      while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
+
+				      GERR (r);
+				      j->http_state = HTTP_STATE_CLOSING;
+			      }
 		      }
-
+		    else
+		    { 
+			    j->http_state = HTTP_STATE_CLOSING;
+			    if (r < 0 && r != GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
+			    {
+				    check_alert (j->tls_session, r);
+				    fprintf (stderr, "Error while receiving data\n");
+				    GERR (r);
+			    }
+		    }
 		  }
 		else
 		  {
@@ -1257,7 +1292,7 @@ main (int argc, char **argv)
 		  }
 	      }
 
-	    if (j->handshake_ok == 1)
+	    if (j->handshake_ok == 1 && j->http_response != NULL)
 	      {
 		/* FIXME if j->http_response == NULL? */
 		r = gnutls_record_send (j->tls_session,
@@ -1309,6 +1344,12 @@ main (int argc, char **argv)
 		      }
 		  }
 	      }
+	    else
+	    {
+		    j->request_length = 0;
+		    j->http_request[0] = 0;
+		    j->http_state = HTTP_STATE_REQUEST;
+	    }
 	  }
       }
       lloopend (listener_list, j);
Index: gnutls-2.4.1/src/tests.c
===================================================================
--- gnutls-2.4.1.orig/src/tests.c
+++ gnutls-2.4.1/src/tests.c
@@ -45,6 +45,7 @@ extern int verbose;
 int tls1_ok = 0;
 int ssl3_ok = 0;
 int tls1_1_ok = 0;
+int tls1_2_ok = 0;
 
 /* keep session info */
 static char *session_data = NULL;
@@ -103,156 +104,32 @@ do_handshake (gnutls_session_t session)
   return TEST_SUCCEED;
 }
 
-static int protocol_priority[16] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
+char protocol_str[] = "+VERS-TLS1.0:+VERS-SSL3.0";
+char prio_str[256] = "";
 static const int kx_priority[16] =
   { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
   GNUTLS_KX_ANON_DH,
   GNUTLS_KX_RSA_EXPORT, 0
 };
-static const int cipher_priority[16] =
-  { GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128,
-  GNUTLS_CIPHER_ARCFOUR_40, 0
-};
-static const int comp_priority[16] = { GNUTLS_COMP_NULL, 0 };
-static const int mac_priority[16] = { GNUTLS_MAC_SHA1, GNUTLS_MAC_MD5, 0 };
-static const int cert_type_priority[16] = { GNUTLS_CRT_X509, 0 };
-
-#define ADD_ALL_CIPHERS(session) gnutls_cipher_set_priority(session, cipher_priority)
-#define ADD_ALL_COMP(session) gnutls_compression_set_priority(session, comp_priority)
-#define ADD_ALL_MACS(session) gnutls_mac_set_priority(session, mac_priority)
-#define ADD_ALL_KX(session) gnutls_kx_set_priority(session, kx_priority)
-#define ADD_ALL_PROTOCOLS(session) gnutls_protocol_set_priority(session, protocol_priority)
-#define ADD_ALL_CERTTYPES(session) gnutls_certificate_type_set_priority(session, cert_type_priority)
-
-static void
-ADD_KX (gnutls_session_t session, int kx)
-{
-  static int _kx_priority[] = { 0, 0 };
-  _kx_priority[0] = kx;
-
-  gnutls_kx_set_priority (session, _kx_priority);
-}
-
-static void
-ADD_KX2 (gnutls_session_t session, int kx1, int kx2)
-{
-  static int _kx_priority[] = { 0, 0, 0 };
-  _kx_priority[0] = kx1;
-  _kx_priority[1] = kx2;
-
-  gnutls_kx_set_priority (session, _kx_priority);
-}
-
-static void
-ADD_CIPHER (gnutls_session_t session, int cipher)
-{
-  static int _cipher_priority[] = { 0, 0 };
-  _cipher_priority[0] = cipher;
-
-  gnutls_cipher_set_priority (session, _cipher_priority);
-}
-
-static void
-ADD_CIPHER4 (gnutls_session_t session, int cipher1, int cipher2, int cipher3,
-	int cipher4)
-{
-  static int _cipher_priority[] = { 0, 0, 0, 0, 0 };
-  _cipher_priority[0] = cipher1;
-  _cipher_priority[1] = cipher2;
-  _cipher_priority[2] = cipher3;
-  _cipher_priority[3] = cipher4;
-
-  gnutls_cipher_set_priority (session, _cipher_priority);
-}
-
-static void
-ADD_MAC (gnutls_session_t session, int mac)
-{
-  static int _mac_priority[] = { 0, 0 };
-  _mac_priority[0] = mac;
-
-  gnutls_mac_set_priority (session, _mac_priority);
-}
-
-static void
-ADD_COMP (gnutls_session_t session, int c)
-{
-  static int _comp_priority[] = { 0, 0 };
-  _comp_priority[0] = c;
-
-  gnutls_compression_set_priority (session, _comp_priority);
-}
-
-static void
-ADD_CERTTYPE (gnutls_session_t session, int ctype)
-{
-  static int _ct_priority[] = { 0, 0 };
-  _ct_priority[0] = ctype;
-
-  gnutls_certificate_type_set_priority (session, _ct_priority);
-}
-
-static void
-ADD_PROTOCOL (gnutls_session_t session, int protocol)
-{
-  static int _proto_priority[] = { 0, 0 };
-  _proto_priority[0] = protocol;
-
-  gnutls_protocol_set_priority (session, _proto_priority);
-}
+#define ALL_CIPHERS "+3DES-CBC:+ARCFOUR-128:+ARCFOUR-40"
+#define ALL_COMP "+COMP-NULL"
+#define ALL_MACS "+SHA1:+MD5"
+#define ALL_CERTTYPES "+CTYPE-X509"
+#define REST "%%UNSAFE_RENEGOTIATION"
+#define ALL_KX "+RSA:+DHE-RSA:+DHE-DSS:+ANON-DH:+RSA-EXPORT"
+#define INIT_STR "NONE:"
 
-static void
-ADD_PROTOCOL3 (gnutls_session_t session, int p1, int p2, int p3)
+static inline void _gnutls_priority_set_direct(gnutls_session_t session, const char* str)
 {
-  static int _proto_priority[] = { 0, 0, 0, 0 };
-  _proto_priority[0] = p1;
-  _proto_priority[1] = p2;
-  _proto_priority[2] = p3;
-
-  gnutls_protocol_set_priority (session, _proto_priority);
-}
-
-#ifdef ENABLE_SRP
-static int srp_detected;
+	const char* err;
+	int ret = gnutls_priority_set_direct(session, str, &err);
 
-int
-_test_srp_username_callback (gnutls_session_t session, 
-    char **username, char **password)
-{
-  srp_detected = 1;
-
-  return -1;
-}
-
-test_code_t
-test_srp (gnutls_session_t session)
-{
-  int ret;
-
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-
-  ADD_KX (session, GNUTLS_KX_SRP);
-  srp_detected = 0;
-
-  gnutls_srp_set_client_credentials_function (srp_cred,
-					      _test_srp_username_callback);
-
-  gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);
-
-  ret = do_handshake (session);
-
-  gnutls_srp_set_client_credentials_function (srp_cred, NULL);
-
-  if (srp_detected != 0)
-    return TEST_SUCCEED;
-  else
-    return TEST_FAILED;
+	if (ret < 0) 
+	{
+		fprintf(stderr, "Error in %s\n", err);
+		exit(1);
+	}
 }
-#endif
 
 test_code_t
 test_server (gnutls_session_t session)
@@ -267,12 +144,8 @@ test_server (gnutls_session_t session)
 
   buf[sizeof (buf) - 1] = 0;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
@@ -316,10 +189,8 @@ test_export (gnutls_session_t session)
 {
   int ret;
 
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
+  sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
   ADD_KX (session, GNUTLS_KX_RSA_EXPORT);
   ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40);
@@ -346,13 +217,9 @@ test_export_info (gnutls_session_t sessi
   if (verbose == 0 || export_true == 0)
     return TEST_IGNORE;
 
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
+  sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
-  ADD_KX (session, GNUTLS_KX_RSA_EXPORT);
-  ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -393,13 +260,9 @@ test_dhe (gnutls_session_t session)
 {
   int ret;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
+  sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+DHE-RSA:+DHE-DSS:"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
-  ADD_KX2 (session, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -410,6 +273,36 @@ test_dhe (gnutls_session_t session)
 }
 
 test_code_t
+test_safe_renegotiation (gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":%%SAFE_RENEGOTIATION", protocol_str);
+	_gnutls_priority_set_direct (session, prio_str);
+
+	gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = do_handshake (session);
+
+	return ret;
+}
+
+test_code_t
+test_safe_renegotiation_scsv (gnutls_session_t session)
+{
+	int ret;
+
+	sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-SSL3.0:"ALL_MACS":"ALL_KX":%%SAFE_RENEGOTIATION");
+	_gnutls_priority_set_direct (session, prio_str);
+
+	gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
+
+	ret = do_handshake (session);
+
+	return ret;
+}
+
+test_code_t
 test_dhe_group (gnutls_session_t session)
 {
   int ret, ret2;
@@ -419,13 +312,8 @@ test_dhe_group (gnutls_session_t session
   if (verbose == 0 || pubkey.data == NULL)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
+  sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+DHE-RSA:+DHE-DSS:"REST, protocol_str);
 
-  ADD_KX2 (session, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -461,12 +349,9 @@ test_code_t
 test_ssl3 (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_PROTOCOL (session, GNUTLS_SSL3);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-SSL3.0:"ALL_MACS":"ALL_KX":"REST);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -494,12 +379,9 @@ test_bye (gnutls_session_t session)
   signal (SIGALRM, got_alarm);
 #endif
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -546,12 +428,10 @@ test_code_t
 test_aes (gnutls_session_t session)
 {
   int ret;
-  ADD_CIPHER (session, GNUTLS_CIPHER_AES_128_CBC);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST , protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -563,12 +443,10 @@ test_code_t
 test_camellia (gnutls_session_t session)
 {
   int ret;
-  ADD_CIPHER (session, GNUTLS_CIPHER_CAMELLIA_128_CBC);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+CAMELLIA-128-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -580,12 +458,10 @@ test_code_t
 test_openpgp1 (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_CERTTYPE (session, GNUTLS_CRT_OPENPGP);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":+CTYPE-OPENPGP:%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -603,17 +479,12 @@ test_unknown_ciphersuites (gnutls_sessio
 {
   int ret;
 #ifdef	ENABLE_CAMELLIA
-  ADD_CIPHER4 (session, GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_3DES_CBC,
-	GNUTLS_CIPHER_CAMELLIA_128_CBC, GNUTLS_CIPHER_ARCFOUR_128);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 #else
-  ADD_CIPHER4 (session, GNUTLS_CIPHER_AES_128_CBC, GNUTLS_CIPHER_3DES_CBC,
-	GNUTLS_CIPHER_ARCFOUR_128, 0);
+  sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 #endif
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -624,12 +495,10 @@ test_code_t
 test_md5 (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_MAC (session, GNUTLS_MAC_MD5);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:+MD5:"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -641,12 +510,10 @@ test_code_t
 test_zlib (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_COMP (session, GNUTLS_COMP_ZLIB);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":+COMP-ZLIB:"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -655,17 +522,11 @@ test_zlib (gnutls_session_t session)
 #endif
 
 test_code_t
-test_lzo (gnutls_session_t session)
+test_sha (gnutls_session_t session)
 {
   int ret;
-  gnutls_handshake_set_private_extensions (session, 1);
-
-  ADD_ALL_CIPHERS (session);
-  ADD_COMP (session, GNUTLS_COMP_LZO);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR "+AES-128-CBC:"ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:+SHA1:"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -674,15 +535,12 @@ test_lzo (gnutls_session_t session)
 }
 
 test_code_t
-test_sha (gnutls_session_t session)
+test_3des (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_MAC (session, GNUTLS_MAC_SHA1);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+3DES-CBC:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -690,15 +548,12 @@ test_sha (gnutls_session_t session)
 }
 
 test_code_t
-test_3des (gnutls_session_t session)
+test_arcfour (gnutls_session_t session)
 {
   int ret;
-  ADD_CIPHER (session, GNUTLS_CIPHER_3DES_CBC);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+ARCFOUR-128:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -706,15 +561,13 @@ test_3des (gnutls_session_t session)
 }
 
 test_code_t
-test_arcfour (gnutls_session_t session)
+test_arcfour_40 (gnutls_session_t session)
 {
   int ret;
-  ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_128);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR "+ARCFOUR-40:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":""+RSA-EXPORT"":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -722,15 +575,13 @@ test_arcfour (gnutls_session_t session)
 }
 
 test_code_t
-test_arcfour_40 (gnutls_session_t session)
+test_tls1 (gnutls_session_t session)
 {
   int ret;
-  ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.0:"ALL_MACS":"ALL_KX":"REST);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -738,20 +589,18 @@ test_arcfour_40 (gnutls_session_t sessio
 }
 
 test_code_t
-test_tls1 (gnutls_session_t session)
+test_tls1_2 (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_PROTOCOL (session, GNUTLS_TLS1);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.2:"ALL_MACS":"ALL_KX":"REST);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
   if (ret == TEST_SUCCEED)
-    tls1_ok = 1;
+    tls1_2_ok = 1;
 
   return ret;
 
@@ -761,12 +610,10 @@ test_code_t
 test_tls1_1 (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_PROTOCOL (session, GNUTLS_TLS1_1);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.1:"ALL_MACS":"ALL_KX":"REST);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -784,12 +631,9 @@ test_tls1_1_fallback (gnutls_session_t s
   if (tls1_1_ok)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_PROTOCOL3 (session, GNUTLS_TLS1_1, GNUTLS_TLS1, GNUTLS_SSL3);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":+VERS-TLS1.1:+VERS-TLS1.0:+VERS-SSL3.0:"ALL_MACS":"ALL_KX":"REST);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -815,12 +659,9 @@ test_tls_disable (gnutls_session_t sessi
   if (tls1_ok != 0)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
+
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -829,8 +670,7 @@ test_tls_disable (gnutls_session_t sessi
       /* disable TLS 1.0 */
       if (ssl3_ok != 0)
 	{
-	  protocol_priority[0] = GNUTLS_SSL3;
-	  protocol_priority[1] = 0;
+	  strcpy(protocol_str, "+VERS-SSL3.0");
 	}
     }
   return ret;
@@ -847,12 +687,8 @@ test_rsa_pms (gnutls_session_t session)
    * If the server is old, buggy and only supports
    * SSL 3.0 then the handshake will fail.
    */
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_KX (session, GNUTLS_KX_RSA);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+RSA:"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
@@ -868,12 +704,8 @@ test_code_t
 test_max_record_size (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   gnutls_record_set_max_size (session, 512);
 
@@ -892,12 +724,9 @@ test_code_t
 test_hello_extension (gnutls_session_t session)
 {
   int ret;
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   gnutls_record_set_max_size (session, 512);
 
@@ -923,12 +752,8 @@ test_version_rollback (gnutls_session_t
    * attacks which allow a version downgrade) and this 
    * connection will fail.
    */
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   _gnutls_record_set_default_version (session, 3, 0);
 
@@ -953,12 +778,8 @@ test_version_oob (gnutls_session_t sessi
   /* here we enable both SSL 3.0 and TLS 1.0
    * and we connect using a 5.5 record version.
    */
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   _gnutls_record_set_default_version (session, 5, 5);
 
@@ -978,12 +799,8 @@ test_rsa_pms_version_check (gnutls_sessi
    *
    * A normal server would abort this handshake.
    */
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   _gnutls_rsa_pms_set_version (session, 5, 5);	/* use SSL 5.5 version */
 
@@ -998,12 +815,8 @@ test_anonymous (gnutls_session_t session
 {
   int ret;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_KX (session, GNUTLS_KX_ANON_DH);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":+ANON-DH:"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred);
 
   ret = do_handshake (session);
@@ -1025,12 +838,8 @@ test_session_resume2 (gnutls_session_t s
   if (session == NULL)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   gnutls_credentials_set (session, GNUTLS_CRD_ANON, anon_cred);
@@ -1072,12 +881,8 @@ test_certificate (gnutls_session_t sessi
   if (verbose == 0)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
@@ -1141,12 +946,8 @@ test_server_cas (gnutls_session_t sessio
   if (verbose == 0)
     return TEST_IGNORE;
 
-  ADD_ALL_CIPHERS (session);
-  ADD_ALL_COMP (session);
-  ADD_ALL_CERTTYPES (session);
-  ADD_ALL_PROTOCOLS (session);
-  ADD_ALL_MACS (session);
-  ADD_ALL_KX (session);
+  sprintf(prio_str, INIT_STR ALL_CIPHERS":"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
+  _gnutls_priority_set_direct (session, prio_str);
 
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
   gnutls_certificate_client_set_retrieve_function (xcred, cert_callback);
Index: gnutls-2.4.1/src/tests.h
===================================================================
--- gnutls-2.4.1.orig/src/tests.h
+++ gnutls-2.4.1/src/tests.h
@@ -3,7 +3,6 @@ typedef enum
   TEST_SUCCEED, TEST_FAILED, TEST_UNSURE, TEST_IGNORE
 } test_code_t;
 
-test_code_t test_srp (gnutls_session_t state);
 test_code_t test_server (gnutls_session_t state);
 test_code_t test_export (gnutls_session_t state);
 test_code_t test_export_info (gnutls_session_t state);
@@ -21,7 +20,10 @@ test_code_t test_3des (gnutls_session_t
 test_code_t test_arcfour (gnutls_session_t state);
 test_code_t test_arcfour_40 (gnutls_session_t state);
 test_code_t test_tls1 (gnutls_session_t state);
+test_code_t test_safe_renegotiation (gnutls_session_t state);
+test_code_t test_safe_renegotiation_scsv (gnutls_session_t state);
 test_code_t test_tls1_1 (gnutls_session_t state);
+test_code_t test_tls1_2 (gnutls_session_t state);
 test_code_t test_tls1_1_fallback (gnutls_session_t state);
 test_code_t test_tls_disable (gnutls_session_t state);
 test_code_t test_rsa_pms (gnutls_session_t state);
@@ -37,6 +39,5 @@ test_code_t test_session_resume2 (gnutls
 test_code_t test_rsa_pms_version_check (gnutls_session_t session);
 test_code_t test_version_oob (gnutls_session_t session);
 test_code_t test_zlib (gnutls_session_t session);
-test_code_t test_lzo (gnutls_session_t session);
 int _test_srp_username_callback (gnutls_session_t session,
 				 char **username, char **password);
Index: gnutls-2.4.1/src/tls_test.c
===================================================================
--- gnutls-2.4.1.orig/src/tls_test.c
+++ gnutls-2.4.1/src/tls_test.c
@@ -75,6 +75,9 @@ typedef struct
 } TLS_TEST;
 
 static const TLS_TEST tls_tests[] = {
+  {"for Safe renegotiation support", test_safe_renegotiation, "yes", "no", "dunno"},
+  {"for Safe renegotiation support (SCSV)", test_safe_renegotiation_scsv, "yes", "no", "dunno"},
+  {"for TLS 1.2 support", test_tls1_2, "yes", "no", "dunno"},
   {"for TLS 1.1 support", test_tls1_1, "yes", "no", "dunno"},
   {"fallback from TLS 1.1 to", test_tls1_1_fallback, "TLS 1.0", "failed",
    "SSL 3.0"},
@@ -135,14 +138,8 @@ static const TLS_TEST tls_tests[] = {
   {"for ZLIB compression support (TLS extension)", test_zlib, "yes",
    "no", "dunno"},
 #endif
-  {"for LZO compression support (GnuTLS extension)", test_lzo, "yes",
-   "no", "dunno"},
   {"for max record size (TLS extension)", test_max_record_size, "yes",
    "no", "dunno"},
-#ifdef ENABLE_SRP
-  {"for SRP authentication support (TLS extension)", test_srp, "yes",
-   "no", "dunno"},
-#endif
   {"for OpenPGP authentication support (TLS extension)", test_openpgp1,
    "yes", "no", "dunno"},
   {NULL, NULL, NULL, NULL, NULL}
@@ -228,7 +225,7 @@ main (int argc, char **argv)
 
       /* if neither of SSL3 and TLSv1 are supported, exit
        */
-      if (i > 3 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0)
+      if (i > 6 && tls1_1_ok == 0 && tls1_ok == 0 && ssl3_ok == 0)
 	{
 	  fprintf (stderr,
 		   "\nServer does not support any of SSL 3.0, TLS 1.0 and TLS 1.1\n");
Index: gnutls-2.4.1/tests/Makefile.am
===================================================================
--- gnutls-2.4.1.orig/tests/Makefile.am
+++ gnutls-2.4.1/tests/Makefile.am
@@ -20,7 +20,7 @@
 # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 
 SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode pkcs12-decode	\
-	userid pathlen key-id sha2 hostname-check
+	userid pathlen key-id sha2 hostname-check safe-renegotiation
 
 if ENABLE_OPENPGP
 SUBDIRS += openpgp openpgp-certs
Index: gnutls-2.4.1/tests/Makefile.in
===================================================================
--- gnutls-2.4.1.orig/tests/Makefile.in
+++ gnutls-2.4.1/tests/Makefile.in
@@ -299,7 +299,7 @@ ETAGS = etags
 CTAGS = ctags
 DIST_SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode \
 	pkcs12-decode userid pathlen key-id sha2 hostname-check \
-	openpgp openpgp-certs
+	openpgp openpgp-certs safe-renegotiation
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 ALLOCA = @ALLOCA@
@@ -705,7 +705,7 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 SUBDIRS = rsa-md5-collision pkcs1-padding pkcs8-decode pkcs12-decode \
-	userid pathlen key-id sha2 hostname-check $(am__append_1)
+	userid pathlen key-id sha2 safe-renegotiation hostname-check $(am__append_1)
 EXTRA_DIST = libgcrypt.supp
 AM_CPPFLAGS = -I$(top_srcdir)/lgl -I$(top_builddir)/lgl			\
 	-I$(top_srcdir)/gl -I$(top_builddir)/gl				\
Index: gnutls-2.4.1/tests/resume.c
===================================================================
--- gnutls-2.4.1.orig/tests/resume.c
+++ gnutls-2.4.1/tests/resume.c
@@ -45,6 +45,9 @@ static int wrap_db_store (void *dbf, gnu
 static gnutls_datum_t wrap_db_fetch (void *dbf, gnutls_datum_t key);
 static int wrap_db_delete (void *dbf, gnutls_datum_t key);
 
+pid_t child;
+
+
 #define TLS_SESSION_CACHE 50
 
 /* A very basic TLS client, with anonymous authentication.
@@ -52,6 +55,12 @@ static int wrap_db_delete (void *dbf, gn
 
 #define MAX_BUF 1024
 #define MSG "Hello TLS"
+static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "%s |<%d>| %s", child ? "server" : "client", level, str);
+}
+		
 
 /* Connects to the peer and returns a socket
  * descriptor.
@@ -106,6 +115,11 @@ client (void)
    */
   int t;
   gnutls_datum session_data;
+  if (debug)
+  {
+	  gnutls_global_set_log_function (tls_log_func);
+	  gnutls_global_set_log_level (2);
+  }
 
   gnutls_global_init ();
 
@@ -333,6 +347,12 @@ server (void)
 {
   /* this must be called once in the program, it is mostly for the server.
    */
+  if (debug)
+  {
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (2);
+  }
+
   gnutls_global_init ();
 
   gnutls_anon_allocate_server_credentials (&anoncred);
@@ -422,8 +442,6 @@ server (void)
 void
 doit (void)
 {
-  pid_t child;
-
   global_start ();
   if (error_count)
     return;
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.am
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.am
@@ -0,0 +1,37 @@
+## Process this file with automake to produce Makefile.in
+# Copyright (C) 2010 Free Software Foundation, Inc.
+#
+# This file is part of GnuTLS.
+#
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This file is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this file; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
+AM_CPPFLAGS = \
+	      -I$(top_srcdir)/lib/includes            \
+	      -I$(top_builddir)/lib/includes
+
+AM_LDFLAGS = -no-install
+LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+
+ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7
+
+check_PROGRAMS = $(ctests)
+TESTS = $(ctests)
+TESTS_ENVIRONMENT = $(VALGRIND)
+
+EXTRA_DIST = README params.dh
+
+dist_check_SCRIPTS = testsrn
+#TESTS = testsrn
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
@@ -0,0 +1,1299 @@
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# Copyright (C) 2010 Free Software Foundation, Inc.
+#
+# This file is part of GnuTLS.
+#
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This file is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this file; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+check_PROGRAMS = $(am__EXEEXT_1)
+TESTS = $(am__EXEEXT_1)
+subdir = tests/safe-renegotiation
+DIST_COMMON = README $(dist_check_SCRIPTS) $(srcdir)/Makefile.am \
+	$(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/libextra/m4/hooks.m4 \
+		      $(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \
+		      $(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \
+		      $(top_srcdir)/gl/m4/arpa_inet_h.m4 \
+		      $(top_srcdir)/gl/m4/asm-underscore.m4 \
+		      $(top_srcdir)/gl/m4/autobuild.m4 \
+		      $(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \
+		      $(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \
+		      $(top_srcdir)/gl/m4/extensions.m4 \
+		      $(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \
+		      $(top_srcdir)/gl/m4/fseeko.m4 \
+		      $(top_srcdir)/gl/m4/getaddrinfo.m4 \
+		      $(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \
+		      $(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \
+		      $(top_srcdir)/gl/m4/gettimeofday.m4 \
+		      $(top_srcdir)/gl/m4/gnulib-common.m4 \
+		      $(top_srcdir)/gl/m4/gnulib-comp.m4 \
+		      $(top_srcdir)/gl/m4/hostent.m4 \
+		      $(top_srcdir)/gl/m4/include_next.m4 \
+		      $(top_srcdir)/gl/m4/inet_ntop.m4 \
+		      $(top_srcdir)/gl/m4/inet_pton.m4 \
+		      $(top_srcdir)/gl/m4/intmax_t.m4 \
+		      $(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \
+		      $(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \
+		      $(top_srcdir)/gl/m4/lib-prefix.m4 \
+		      $(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \
+		      $(top_srcdir)/gl/m4/malloc.m4 \
+		      $(top_srcdir)/gl/m4/manywarnings.m4 \
+		      $(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \
+		      $(top_srcdir)/gl/m4/mmap-anon.m4 \
+		      $(top_srcdir)/gl/m4/multiarch.m4 \
+		      $(top_srcdir)/gl/m4/netdb_h.m4 \
+		      $(top_srcdir)/gl/m4/netinet_in_h.m4 \
+		      $(top_srcdir)/gl/m4/onceonly_2_57.m4 \
+		      $(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \
+		      $(top_srcdir)/gl/m4/read-file.m4 \
+		      $(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \
+		      $(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \
+		      $(top_srcdir)/gl/m4/size_max.m4 \
+		      $(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \
+		      $(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \
+		      $(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \
+		      $(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \
+		      $(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \
+		      $(top_srcdir)/gl/m4/stdlib_h.m4 \
+		      $(top_srcdir)/gl/m4/strerror.m4 \
+		      $(top_srcdir)/gl/m4/string_h.m4 \
+		      $(top_srcdir)/gl/m4/sys_ioctl_h.m4 \
+		      $(top_srcdir)/gl/m4/sys_select_h.m4 \
+		      $(top_srcdir)/gl/m4/sys_socket_h.m4 \
+		      $(top_srcdir)/gl/m4/sys_stat_h.m4 \
+		      $(top_srcdir)/gl/m4/sys_time_h.m4 \
+		      $(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \
+		      $(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \
+		      $(top_srcdir)/gl/m4/valgrind-tests.m4 \
+		      $(top_srcdir)/gl/m4/vasnprintf.m4 \
+		      $(top_srcdir)/gl/m4/version-etc.m4 \
+		      $(top_srcdir)/gl/m4/warn-on-use.m4 \
+		      $(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \
+		      $(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \
+		      $(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \
+		      $(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \
+		      $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+		      $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+		      $(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+		     	$(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__EXEEXT_1 = srn0$(EXEEXT) srn1$(EXEEXT) srn2$(EXEEXT) srn3$(EXEEXT) \
+	       	srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT)
+srn0_SOURCES = srn0.c
+srn0_OBJECTS = srn0.$(OBJEXT)
+srn0_LDADD = $(LDADD)
+am__DEPENDENCIES_1 =
+srn0_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn1_SOURCES = srn1.c
+srn1_OBJECTS = srn1.$(OBJEXT)
+srn1_LDADD = $(LDADD)
+srn1_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn2_SOURCES = srn2.c
+srn2_OBJECTS = srn2.$(OBJEXT)
+srn2_LDADD = $(LDADD)
+srn2_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn3_SOURCES = srn3.c
+srn3_OBJECTS = srn3.$(OBJEXT)
+srn3_LDADD = $(LDADD)
+srn3_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn4_SOURCES = srn4.c
+srn4_OBJECTS = srn4.$(OBJEXT)
+srn4_LDADD = $(LDADD)
+srn4_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn5_SOURCES = srn5.c
+srn5_OBJECTS = srn5.$(OBJEXT)
+srn5_LDADD = $(LDADD)
+srn5_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn6_SOURCES = srn6.c
+srn6_OBJECTS = srn6.$(OBJEXT)
+srn6_LDADD = $(LDADD)
+srn6_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+srn7_SOURCES = srn7.c
+srn7_OBJECTS = srn7.$(OBJEXT)
+srn7_LDADD = $(LDADD)
+srn7_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
+		    	$(am__DEPENDENCIES_1)
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp
+am__depfiles_maybe = depfiles
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	  	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+	    	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+			$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+CCLD = $(CC)
+LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
+       	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+		$(LDFLAGS) -o $@
+SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c
+DIST_SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c
+ETAGS = etags
+CTAGS = ctags
+am__tty_colors = \
+		 red=; grn=; lgn=; blu=; std=
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+ALLOCA = @ALLOCA@
+ALLOCA_H = @ALLOCA_H@
+AMTAR = @AMTAR@
+APPLE_UNIVERSAL_BUILD = @APPLE_UNIVERSAL_BUILD@
+AR = @AR@
+AS = @AS@
+ASM_SYMBOL_PREFIX = @ASM_SYMBOL_PREFIX@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+BITSIZEOF_PTRDIFF_T = @BITSIZEOF_PTRDIFF_T@
+BITSIZEOF_SIG_ATOMIC_T = @BITSIZEOF_SIG_ATOMIC_T@
+BITSIZEOF_SIZE_T = @BITSIZEOF_SIZE_T@
+BITSIZEOF_WCHAR_T = @BITSIZEOF_WCHAR_T@
+BITSIZEOF_WINT_T = @BITSIZEOF_WINT_T@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CONFIG_INCLUDE = @CONFIG_INCLUDE@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CXX = @CXX@
+CXXCPP = @CXXCPP@
+CXXDEPMODE = @CXXDEPMODE@
+CXXFLAGS = @CXXFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
+DLL_VERSION = @DLL_VERSION@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EMULTIHOP_HIDDEN = @EMULTIHOP_HIDDEN@
+EMULTIHOP_VALUE = @EMULTIHOP_VALUE@
+ENOLINK_HIDDEN = @ENOLINK_HIDDEN@
+ENOLINK_VALUE = @ENOLINK_VALUE@
+EOVERFLOW_HIDDEN = @EOVERFLOW_HIDDEN@
+EOVERFLOW_VALUE = @EOVERFLOW_VALUE@
+ERRNO_H = @ERRNO_H@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+FLOAT_H = @FLOAT_H@
+GAA = @GAA@
+GETADDRINFO_LIB = @GETADDRINFO_LIB@
+GNULIB_ACCEPT = @GNULIB_ACCEPT@
+GNULIB_ACCEPT4 = @GNULIB_ACCEPT4@
+GNULIB_ATOLL = @GNULIB_ATOLL@
+GNULIB_BIND = @GNULIB_BIND@
+GNULIB_BTOWC = @GNULIB_BTOWC@
+GNULIB_CALLOC_POSIX = @GNULIB_CALLOC_POSIX@
+GNULIB_CANONICALIZE_FILE_NAME = @GNULIB_CANONICALIZE_FILE_NAME@
+GNULIB_CHOWN = @GNULIB_CHOWN@
+GNULIB_CLOSE = @GNULIB_CLOSE@
+GNULIB_CONNECT = @GNULIB_CONNECT@
+GNULIB_DPRINTF = @GNULIB_DPRINTF@
+GNULIB_DUP2 = @GNULIB_DUP2@
+GNULIB_DUP3 = @GNULIB_DUP3@
+GNULIB_ENVIRON = @GNULIB_ENVIRON@
+GNULIB_EUIDACCESS = @GNULIB_EUIDACCESS@
+GNULIB_FACCESSAT = @GNULIB_FACCESSAT@
+GNULIB_FCHDIR = @GNULIB_FCHDIR@
+GNULIB_FCHMODAT = @GNULIB_FCHMODAT@
+GNULIB_FCHOWNAT = @GNULIB_FCHOWNAT@
+GNULIB_FCLOSE = @GNULIB_FCLOSE@
+GNULIB_FFLUSH = @GNULIB_FFLUSH@
+GNULIB_FOPEN = @GNULIB_FOPEN@
+GNULIB_FPRINTF = @GNULIB_FPRINTF@
+GNULIB_FPRINTF_POSIX = @GNULIB_FPRINTF_POSIX@
+GNULIB_FPURGE = @GNULIB_FPURGE@
+GNULIB_FPUTC = @GNULIB_FPUTC@
+GNULIB_FPUTS = @GNULIB_FPUTS@
+GNULIB_FREOPEN = @GNULIB_FREOPEN@
+GNULIB_FSEEK = @GNULIB_FSEEK@
+GNULIB_FSEEKO = @GNULIB_FSEEKO@
+GNULIB_FSTATAT = @GNULIB_FSTATAT@
+GNULIB_FSYNC = @GNULIB_FSYNC@
+GNULIB_FTELL = @GNULIB_FTELL@
+GNULIB_FTELLO = @GNULIB_FTELLO@
+GNULIB_FTRUNCATE = @GNULIB_FTRUNCATE@
+GNULIB_FUTIMENS = @GNULIB_FUTIMENS@
+GNULIB_FWRITE = @GNULIB_FWRITE@
+GNULIB_GETADDRINFO = @GNULIB_GETADDRINFO@
+GNULIB_GETCWD = @GNULIB_GETCWD@
+GNULIB_GETDELIM = @GNULIB_GETDELIM@
+GNULIB_GETDOMAINNAME = @GNULIB_GETDOMAINNAME@
+GNULIB_GETDTABLESIZE = @GNULIB_GETDTABLESIZE@
+GNULIB_GETGROUPS = @GNULIB_GETGROUPS@
+GNULIB_GETHOSTNAME = @GNULIB_GETHOSTNAME@
+GNULIB_GETLINE = @GNULIB_GETLINE@
+GNULIB_GETLOADAVG = @GNULIB_GETLOADAVG@
+GNULIB_GETLOGIN = @GNULIB_GETLOGIN@
+GNULIB_GETLOGIN_R = @GNULIB_GETLOGIN_R@
+GNULIB_GETPAGESIZE = @GNULIB_GETPAGESIZE@
+GNULIB_GETPEERNAME = @GNULIB_GETPEERNAME@
+GNULIB_GETSOCKNAME = @GNULIB_GETSOCKNAME@
+GNULIB_GETSOCKOPT = @GNULIB_GETSOCKOPT@
+GNULIB_GETSUBOPT = @GNULIB_GETSUBOPT@
+GNULIB_GETTIMEOFDAY = @GNULIB_GETTIMEOFDAY@
+GNULIB_GETUSERSHELL = @GNULIB_GETUSERSHELL@
+GNULIB_GRANTPT = @GNULIB_GRANTPT@
+GNULIB_INET_NTOP = @GNULIB_INET_NTOP@
+GNULIB_INET_PTON = @GNULIB_INET_PTON@
+GNULIB_IOCTL = @GNULIB_IOCTL@
+GNULIB_LCHMOD = @GNULIB_LCHMOD@
+GNULIB_LCHOWN = @GNULIB_LCHOWN@
+GNULIB_LINK = @GNULIB_LINK@
+GNULIB_LINKAT = @GNULIB_LINKAT@
+GNULIB_LISTEN = @GNULIB_LISTEN@
+GNULIB_LSEEK = @GNULIB_LSEEK@
+GNULIB_LSTAT = @GNULIB_LSTAT@
+GNULIB_MALLOC_POSIX = @GNULIB_MALLOC_POSIX@
+GNULIB_MBRLEN = @GNULIB_MBRLEN@
+GNULIB_MBRTOWC = @GNULIB_MBRTOWC@
+GNULIB_MBSCASECMP = @GNULIB_MBSCASECMP@
+GNULIB_MBSCASESTR = @GNULIB_MBSCASESTR@
+GNULIB_MBSCHR = @GNULIB_MBSCHR@
+GNULIB_MBSCSPN = @GNULIB_MBSCSPN@
+GNULIB_MBSINIT = @GNULIB_MBSINIT@
+GNULIB_MBSLEN = @GNULIB_MBSLEN@
+GNULIB_MBSNCASECMP = @GNULIB_MBSNCASECMP@
+GNULIB_MBSNLEN = @GNULIB_MBSNLEN@
+GNULIB_MBSNRTOWCS = @GNULIB_MBSNRTOWCS@
+GNULIB_MBSPBRK = @GNULIB_MBSPBRK@
+GNULIB_MBSPCASECMP = @GNULIB_MBSPCASECMP@
+GNULIB_MBSRCHR = @GNULIB_MBSRCHR@
+GNULIB_MBSRTOWCS = @GNULIB_MBSRTOWCS@
+GNULIB_MBSSEP = @GNULIB_MBSSEP@
+GNULIB_MBSSPN = @GNULIB_MBSSPN@
+GNULIB_MBSSTR = @GNULIB_MBSSTR@
+GNULIB_MBSTOK_R = @GNULIB_MBSTOK_R@
+GNULIB_MEMCHR = @GNULIB_MEMCHR@
+GNULIB_MEMMEM = @GNULIB_MEMMEM@
+GNULIB_MEMPCPY = @GNULIB_MEMPCPY@
+GNULIB_MEMRCHR = @GNULIB_MEMRCHR@
+GNULIB_MKDIRAT = @GNULIB_MKDIRAT@
+GNULIB_MKDTEMP = @GNULIB_MKDTEMP@
+GNULIB_MKFIFO = @GNULIB_MKFIFO@
+GNULIB_MKFIFOAT = @GNULIB_MKFIFOAT@
+GNULIB_MKNOD = @GNULIB_MKNOD@
+GNULIB_MKNODAT = @GNULIB_MKNODAT@
+GNULIB_MKOSTEMP = @GNULIB_MKOSTEMP@
+GNULIB_MKOSTEMPS = @GNULIB_MKOSTEMPS@
+GNULIB_MKSTEMP = @GNULIB_MKSTEMP@
+GNULIB_MKSTEMPS = @GNULIB_MKSTEMPS@
+GNULIB_MKTIME = @GNULIB_MKTIME@
+GNULIB_NANOSLEEP = @GNULIB_NANOSLEEP@
+GNULIB_OBSTACK_PRINTF = @GNULIB_OBSTACK_PRINTF@
+GNULIB_OBSTACK_PRINTF_POSIX = @GNULIB_OBSTACK_PRINTF_POSIX@
+GNULIB_PERROR = @GNULIB_PERROR@
+GNULIB_PIPE2 = @GNULIB_PIPE2@
+GNULIB_POPEN = @GNULIB_POPEN@
+GNULIB_PREAD = @GNULIB_PREAD@
+GNULIB_PRINTF = @GNULIB_PRINTF@
+GNULIB_PRINTF_POSIX = @GNULIB_PRINTF_POSIX@
+GNULIB_PTSNAME = @GNULIB_PTSNAME@
+GNULIB_PUTC = @GNULIB_PUTC@
+GNULIB_PUTCHAR = @GNULIB_PUTCHAR@
+GNULIB_PUTENV = @GNULIB_PUTENV@
+GNULIB_PUTS = @GNULIB_PUTS@
+GNULIB_PWRITE = @GNULIB_PWRITE@
+GNULIB_RANDOM_R = @GNULIB_RANDOM_R@
+GNULIB_RAWMEMCHR = @GNULIB_RAWMEMCHR@
+GNULIB_READLINK = @GNULIB_READLINK@
+GNULIB_READLINKAT = @GNULIB_READLINKAT@
+GNULIB_REALLOC_POSIX = @GNULIB_REALLOC_POSIX@
+GNULIB_REALPATH = @GNULIB_REALPATH@
+GNULIB_RECV = @GNULIB_RECV@
+GNULIB_RECVFROM = @GNULIB_RECVFROM@
+GNULIB_REMOVE = @GNULIB_REMOVE@
+GNULIB_RENAME = @GNULIB_RENAME@
+GNULIB_RENAMEAT = @GNULIB_RENAMEAT@
+GNULIB_RMDIR = @GNULIB_RMDIR@
+GNULIB_RPMATCH = @GNULIB_RPMATCH@
+GNULIB_SELECT = @GNULIB_SELECT@
+GNULIB_SEND = @GNULIB_SEND@
+GNULIB_SENDTO = @GNULIB_SENDTO@
+GNULIB_SETENV = @GNULIB_SETENV@
+GNULIB_SETSOCKOPT = @GNULIB_SETSOCKOPT@
+GNULIB_SHUTDOWN = @GNULIB_SHUTDOWN@
+GNULIB_SLEEP = @GNULIB_SLEEP@
+GNULIB_SNPRINTF = @GNULIB_SNPRINTF@
+GNULIB_SOCKET = @GNULIB_SOCKET@
+GNULIB_SPRINTF_POSIX = @GNULIB_SPRINTF_POSIX@
+GNULIB_STAT = @GNULIB_STAT@
+GNULIB_STDIO_H_SIGPIPE = @GNULIB_STDIO_H_SIGPIPE@
+GNULIB_STPCPY = @GNULIB_STPCPY@
+GNULIB_STPNCPY = @GNULIB_STPNCPY@
+GNULIB_STRCASESTR = @GNULIB_STRCASESTR@
+GNULIB_STRCHRNUL = @GNULIB_STRCHRNUL@
+GNULIB_STRDUP = @GNULIB_STRDUP@
+GNULIB_STRERROR = @GNULIB_STRERROR@
+GNULIB_STRNCAT = @GNULIB_STRNCAT@
+GNULIB_STRNDUP = @GNULIB_STRNDUP@
+GNULIB_STRNLEN = @GNULIB_STRNLEN@
+GNULIB_STRPBRK = @GNULIB_STRPBRK@
+GNULIB_STRPTIME = @GNULIB_STRPTIME@
+GNULIB_STRSEP = @GNULIB_STRSEP@
+GNULIB_STRSIGNAL = @GNULIB_STRSIGNAL@
+GNULIB_STRSTR = @GNULIB_STRSTR@
+GNULIB_STRTOD = @GNULIB_STRTOD@
+GNULIB_STRTOK_R = @GNULIB_STRTOK_R@
+GNULIB_STRTOLL = @GNULIB_STRTOLL@
+GNULIB_STRTOULL = @GNULIB_STRTOULL@
+GNULIB_STRVERSCMP = @GNULIB_STRVERSCMP@
+GNULIB_SYMLINK = @GNULIB_SYMLINK@
+GNULIB_SYMLINKAT = @GNULIB_SYMLINKAT@
+GNULIB_TIMEGM = @GNULIB_TIMEGM@
+GNULIB_TIME_R = @GNULIB_TIME_R@
+GNULIB_TMPFILE = @GNULIB_TMPFILE@
+GNULIB_TTYNAME_R = @GNULIB_TTYNAME_R@
+GNULIB_UNISTD_H_GETOPT = @GNULIB_UNISTD_H_GETOPT@
+GNULIB_UNISTD_H_SIGPIPE = @GNULIB_UNISTD_H_SIGPIPE@
+GNULIB_UNLINK = @GNULIB_UNLINK@
+GNULIB_UNLINKAT = @GNULIB_UNLINKAT@
+GNULIB_UNLOCKPT = @GNULIB_UNLOCKPT@
+GNULIB_UNSETENV = @GNULIB_UNSETENV@
+GNULIB_USLEEP = @GNULIB_USLEEP@
+GNULIB_UTIMENSAT = @GNULIB_UTIMENSAT@
+GNULIB_VASPRINTF = @GNULIB_VASPRINTF@
+GNULIB_VDPRINTF = @GNULIB_VDPRINTF@
+GNULIB_VFPRINTF = @GNULIB_VFPRINTF@
+GNULIB_VFPRINTF_POSIX = @GNULIB_VFPRINTF_POSIX@
+GNULIB_VPRINTF = @GNULIB_VPRINTF@
+GNULIB_VPRINTF_POSIX = @GNULIB_VPRINTF_POSIX@
+GNULIB_VSNPRINTF = @GNULIB_VSNPRINTF@
+GNULIB_VSPRINTF_POSIX = @GNULIB_VSPRINTF_POSIX@
+GNULIB_WCRTOMB = @GNULIB_WCRTOMB@
+GNULIB_WCSNRTOMBS = @GNULIB_WCSNRTOMBS@
+GNULIB_WCSRTOMBS = @GNULIB_WCSRTOMBS@
+GNULIB_WCTOB = @GNULIB_WCTOB@
+GNULIB_WCWIDTH = @GNULIB_WCWIDTH@
+GNULIB_WRITE = @GNULIB_WRITE@
+GREP = @GREP@
+GTKDOC_CHECK = @GTKDOC_CHECK@
+GTKDOC_MKPDF = @GTKDOC_MKPDF@
+GTKDOC_REBASE = @GTKDOC_REBASE@
+GUILE = @GUILE@
+GUILE_CFLAGS = @GUILE_CFLAGS@
+GUILE_CONFIG = @GUILE_CONFIG@
+GUILE_LDFLAGS = @GUILE_LDFLAGS@
+GUILE_SITE = @GUILE_SITE@
+GUILE_TOOLS = @GUILE_TOOLS@
+HAVE_ACCEPT4 = @HAVE_ACCEPT4@
+HAVE_ARPA_INET_H = @HAVE_ARPA_INET_H@
+HAVE_ATOLL = @HAVE_ATOLL@
+HAVE_BTOWC = @HAVE_BTOWC@
+HAVE_CALLOC_POSIX = @HAVE_CALLOC_POSIX@
+HAVE_CANONICALIZE_FILE_NAME = @HAVE_CANONICALIZE_FILE_NAME@
+HAVE_CHOWN = @HAVE_CHOWN@
+HAVE_DECL_ENVIRON = @HAVE_DECL_ENVIRON@
+HAVE_DECL_FPURGE = @HAVE_DECL_FPURGE@
+HAVE_DECL_FREEADDRINFO = @HAVE_DECL_FREEADDRINFO@
+HAVE_DECL_GAI_STRERROR = @HAVE_DECL_GAI_STRERROR@
+HAVE_DECL_GETADDRINFO = @HAVE_DECL_GETADDRINFO@
+HAVE_DECL_GETDELIM = @HAVE_DECL_GETDELIM@
+HAVE_DECL_GETLINE = @HAVE_DECL_GETLINE@
+HAVE_DECL_GETLOADAVG = @HAVE_DECL_GETLOADAVG@
+HAVE_DECL_GETLOGIN_R = @HAVE_DECL_GETLOGIN_R@
+HAVE_DECL_GETNAMEINFO = @HAVE_DECL_GETNAMEINFO@
+HAVE_DECL_GETPAGESIZE = @HAVE_DECL_GETPAGESIZE@
+HAVE_DECL_GETUSERSHELL = @HAVE_DECL_GETUSERSHELL@
+HAVE_DECL_INET_NTOP = @HAVE_DECL_INET_NTOP@
+HAVE_DECL_INET_PTON = @HAVE_DECL_INET_PTON@
+HAVE_DECL_MEMMEM = @HAVE_DECL_MEMMEM@
+HAVE_DECL_MEMRCHR = @HAVE_DECL_MEMRCHR@
+HAVE_DECL_OBSTACK_PRINTF = @HAVE_DECL_OBSTACK_PRINTF@
+HAVE_DECL_SNPRINTF = @HAVE_DECL_SNPRINTF@
+HAVE_DECL_STRDUP = @HAVE_DECL_STRDUP@
+HAVE_DECL_STRNDUP = @HAVE_DECL_STRNDUP@
+HAVE_DECL_STRNLEN = @HAVE_DECL_STRNLEN@
+HAVE_DECL_STRSIGNAL = @HAVE_DECL_STRSIGNAL@
+HAVE_DECL_STRTOK_R = @HAVE_DECL_STRTOK_R@
+HAVE_DECL_VSNPRINTF = @HAVE_DECL_VSNPRINTF@
+HAVE_DECL_WCTOB = @HAVE_DECL_WCTOB@
+HAVE_DECL_WCWIDTH = @HAVE_DECL_WCWIDTH@
+HAVE_DPRINTF = @HAVE_DPRINTF@
+HAVE_DUP2 = @HAVE_DUP2@
+HAVE_DUP3 = @HAVE_DUP3@
+HAVE_EUIDACCESS = @HAVE_EUIDACCESS@
+HAVE_FACCESSAT = @HAVE_FACCESSAT@
+HAVE_FCHDIR = @HAVE_FCHDIR@
+HAVE_FCHMODAT = @HAVE_FCHMODAT@
+HAVE_FCHOWNAT = @HAVE_FCHOWNAT@
+HAVE_FSEEKO = @HAVE_FSEEKO@
+HAVE_FSTATAT = @HAVE_FSTATAT@
+HAVE_FSYNC = @HAVE_FSYNC@
+HAVE_FTELLO = @HAVE_FTELLO@
+HAVE_FTRUNCATE = @HAVE_FTRUNCATE@
+HAVE_FUTIMENS = @HAVE_FUTIMENS@
+HAVE_GETDOMAINNAME = @HAVE_GETDOMAINNAME@
+HAVE_GETDTABLESIZE = @HAVE_GETDTABLESIZE@
+HAVE_GETGROUPS = @HAVE_GETGROUPS@
+HAVE_GETHOSTNAME = @HAVE_GETHOSTNAME@
+HAVE_GETLOGIN = @HAVE_GETLOGIN@
+HAVE_GETPAGESIZE = @HAVE_GETPAGESIZE@
+HAVE_GETSUBOPT = @HAVE_GETSUBOPT@
+HAVE_GETTIMEOFDAY = @HAVE_GETTIMEOFDAY@
+HAVE_GRANTPT = @HAVE_GRANTPT@
+HAVE_INTTYPES_H = @HAVE_INTTYPES_H@
+HAVE_LCHMOD = @HAVE_LCHMOD@
+HAVE_LCHOWN = @HAVE_LCHOWN@
+HAVE_LIBGCRYPT = @HAVE_LIBGCRYPT@
+HAVE_LIBTASN1 = @HAVE_LIBTASN1@
+HAVE_LINK = @HAVE_LINK@
+HAVE_LINKAT = @HAVE_LINKAT@
+HAVE_LOCALTIME_R = @HAVE_LOCALTIME_R@
+HAVE_LONG_LONG_INT = @HAVE_LONG_LONG_INT@
+HAVE_LSTAT = @HAVE_LSTAT@
+HAVE_MALLOC_POSIX = @HAVE_MALLOC_POSIX@
+HAVE_MBRLEN = @HAVE_MBRLEN@
+HAVE_MBRTOWC = @HAVE_MBRTOWC@
+HAVE_MBSINIT = @HAVE_MBSINIT@
+HAVE_MBSLEN = @HAVE_MBSLEN@
+HAVE_MBSNRTOWCS = @HAVE_MBSNRTOWCS@
+HAVE_MBSRTOWCS = @HAVE_MBSRTOWCS@
+HAVE_MEMCHR = @HAVE_MEMCHR@
+HAVE_MEMPCPY = @HAVE_MEMPCPY@
+HAVE_MKDIRAT = @HAVE_MKDIRAT@
+HAVE_MKDTEMP = @HAVE_MKDTEMP@
+HAVE_MKFIFO = @HAVE_MKFIFO@
+HAVE_MKFIFOAT = @HAVE_MKFIFOAT@
+HAVE_MKNOD = @HAVE_MKNOD@
+HAVE_MKNODAT = @HAVE_MKNODAT@
+HAVE_MKOSTEMP = @HAVE_MKOSTEMP@
+HAVE_MKOSTEMPS = @HAVE_MKOSTEMPS@
+HAVE_MKSTEMP = @HAVE_MKSTEMP@
+HAVE_MKSTEMPS = @HAVE_MKSTEMPS@
+HAVE_NANOSLEEP = @HAVE_NANOSLEEP@
+HAVE_NETDB_H = @HAVE_NETDB_H@
+HAVE_NETINET_IN_H = @HAVE_NETINET_IN_H@
+HAVE_OS_H = @HAVE_OS_H@
+HAVE_PIPE2 = @HAVE_PIPE2@
+HAVE_PREAD = @HAVE_PREAD@
+HAVE_PTSNAME = @HAVE_PTSNAME@
+HAVE_PWRITE = @HAVE_PWRITE@
+HAVE_RANDOM_H = @HAVE_RANDOM_H@
+HAVE_RANDOM_R = @HAVE_RANDOM_R@
+HAVE_RAWMEMCHR = @HAVE_RAWMEMCHR@
+HAVE_READLINK = @HAVE_READLINK@
+HAVE_READLINKAT = @HAVE_READLINKAT@
+HAVE_REALLOC_POSIX = @HAVE_REALLOC_POSIX@
+HAVE_REALPATH = @HAVE_REALPATH@
+HAVE_RENAMEAT = @HAVE_RENAMEAT@
+HAVE_RPMATCH = @HAVE_RPMATCH@
+HAVE_SA_FAMILY_T = @HAVE_SA_FAMILY_T@
+HAVE_SETENV = @HAVE_SETENV@
+HAVE_SIGNED_SIG_ATOMIC_T = @HAVE_SIGNED_SIG_ATOMIC_T@
+HAVE_SIGNED_WCHAR_T = @HAVE_SIGNED_WCHAR_T@
+HAVE_SIGNED_WINT_T = @HAVE_SIGNED_WINT_T@
+HAVE_SLEEP = @HAVE_SLEEP@
+HAVE_STDINT_H = @HAVE_STDINT_H@
+HAVE_STPCPY = @HAVE_STPCPY@
+HAVE_STPNCPY = @HAVE_STPNCPY@
+HAVE_STRCASESTR = @HAVE_STRCASESTR@
+HAVE_STRCHRNUL = @HAVE_STRCHRNUL@
+HAVE_STRPBRK = @HAVE_STRPBRK@
+HAVE_STRPTIME = @HAVE_STRPTIME@
+HAVE_STRSEP = @HAVE_STRSEP@
+HAVE_STRTOD = @HAVE_STRTOD@
+HAVE_STRTOLL = @HAVE_STRTOLL@
+HAVE_STRTOULL = @HAVE_STRTOULL@
+HAVE_STRUCT_ADDRINFO = @HAVE_STRUCT_ADDRINFO@
+HAVE_STRUCT_RANDOM_DATA = @HAVE_STRUCT_RANDOM_DATA@
+HAVE_STRUCT_SOCKADDR_STORAGE = @HAVE_STRUCT_SOCKADDR_STORAGE@
+HAVE_STRUCT_TIMEVAL = @HAVE_STRUCT_TIMEVAL@
+HAVE_STRVERSCMP = @HAVE_STRVERSCMP@
+HAVE_SYMLINK = @HAVE_SYMLINK@
+HAVE_SYMLINKAT = @HAVE_SYMLINKAT@
+HAVE_SYS_BITYPES_H = @HAVE_SYS_BITYPES_H@
+HAVE_SYS_INTTYPES_H = @HAVE_SYS_INTTYPES_H@
+HAVE_SYS_IOCTL_H = @HAVE_SYS_IOCTL_H@
+HAVE_SYS_LOADAVG_H = @HAVE_SYS_LOADAVG_H@
+HAVE_SYS_PARAM_H = @HAVE_SYS_PARAM_H@
+HAVE_SYS_SELECT_H = @HAVE_SYS_SELECT_H@
+HAVE_SYS_SOCKET_H = @HAVE_SYS_SOCKET_H@
+HAVE_SYS_TIME_H = @HAVE_SYS_TIME_H@
+HAVE_SYS_TYPES_H = @HAVE_SYS_TYPES_H@
+HAVE_TIMEGM = @HAVE_TIMEGM@
+HAVE_TTYNAME_R = @HAVE_TTYNAME_R@
+HAVE_UNISTD_H = @HAVE_UNISTD_H@
+HAVE_UNLINKAT = @HAVE_UNLINKAT@
+HAVE_UNLOCKPT = @HAVE_UNLOCKPT@
+HAVE_UNSETENV = @HAVE_UNSETENV@
+HAVE_UNSIGNED_LONG_LONG_INT = @HAVE_UNSIGNED_LONG_LONG_INT@
+HAVE_USLEEP = @HAVE_USLEEP@
+HAVE_UTIMENSAT = @HAVE_UTIMENSAT@
+HAVE_VASPRINTF = @HAVE_VASPRINTF@
+HAVE_VDPRINTF = @HAVE_VDPRINTF@
+HAVE_WCHAR_H = @HAVE_WCHAR_H@
+HAVE_WCHAR_T = @HAVE_WCHAR_T@
+HAVE_WCRTOMB = @HAVE_WCRTOMB@
+HAVE_WCSNRTOMBS = @HAVE_WCSNRTOMBS@
+HAVE_WCSRTOMBS = @HAVE_WCSRTOMBS@
+HAVE_WINSOCK2_H = @HAVE_WINSOCK2_H@
+HAVE_WINT_T = @HAVE_WINT_T@
+HAVE_WS2TCPIP_H = @HAVE_WS2TCPIP_H@
+HAVE__BOOL = @HAVE__BOOL@
+HOSTENT_LIB = @HOSTENT_LIB@
+HTML_DIR = @HTML_DIR@
+INCLUDE_NEXT = @INCLUDE_NEXT@
+INCLUDE_NEXT_AS_FIRST_DIRECTIVE = @INCLUDE_NEXT_AS_FIRST_DIRECTIVE@
+INET_NTOP_LIB = @INET_NTOP_LIB@
+INET_PTON_LIB = @INET_PTON_LIB@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LIBGCRYPT = @LIBGCRYPT@
+LIBGCRYPT_PREFIX = @LIBGCRYPT_PREFIX@
+LIBINTL = @LIBINTL@
+LIBOBJS = @LIBOBJS@
+LIBREADLINE = @LIBREADLINE@
+LIBS = @LIBS@
+LIBSOCKET = @LIBSOCKET@
+LIBTASN1 = @LIBTASN1@
+LIBTASN1_PREFIX = @LIBTASN1_PREFIX@
+LIBTESTS_LIBDEPS = @LIBTESTS_LIBDEPS@
+LIBTOOL = @LIBTOOL@
+LIB_CLOCK_GETTIME = @LIB_CLOCK_GETTIME@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTALLOCA = @LTALLOCA@
+LTLIBGCRYPT = @LTLIBGCRYPT@
+LTLIBINTL = @LTLIBINTL@
+LTLIBOBJS = @LTLIBOBJS@
+LTLIBREADLINE = @LTLIBREADLINE@
+LTLIBTASN1 = @LTLIBTASN1@
+LT_AGE = @LT_AGE@
+LT_CURRENT = @LT_CURRENT@
+LT_REVISION = @LT_REVISION@
+LZO_LIBS = @LZO_LIBS@
+MAKEINFO = @MAKEINFO@
+MKDIR_P = @MKDIR_P@
+NETINET_IN_H = @NETINET_IN_H@
+NEXT_ARPA_INET_H = @NEXT_ARPA_INET_H@
+NEXT_AS_FIRST_DIRECTIVE_ARPA_INET_H = @NEXT_AS_FIRST_DIRECTIVE_ARPA_INET_H@
+NEXT_AS_FIRST_DIRECTIVE_ERRNO_H = @NEXT_AS_FIRST_DIRECTIVE_ERRNO_H@
+NEXT_AS_FIRST_DIRECTIVE_FLOAT_H = @NEXT_AS_FIRST_DIRECTIVE_FLOAT_H@
+NEXT_AS_FIRST_DIRECTIVE_NETDB_H = @NEXT_AS_FIRST_DIRECTIVE_NETDB_H@
+NEXT_AS_FIRST_DIRECTIVE_NETINET_IN_H = @NEXT_AS_FIRST_DIRECTIVE_NETINET_IN_H@
+NEXT_AS_FIRST_DIRECTIVE_STDARG_H = @NEXT_AS_FIRST_DIRECTIVE_STDARG_H@
+NEXT_AS_FIRST_DIRECTIVE_STDDEF_H = @NEXT_AS_FIRST_DIRECTIVE_STDDEF_H@
+NEXT_AS_FIRST_DIRECTIVE_STDINT_H = @NEXT_AS_FIRST_DIRECTIVE_STDINT_H@
+NEXT_AS_FIRST_DIRECTIVE_STDIO_H = @NEXT_AS_FIRST_DIRECTIVE_STDIO_H@
+NEXT_AS_FIRST_DIRECTIVE_STDLIB_H = @NEXT_AS_FIRST_DIRECTIVE_STDLIB_H@
+NEXT_AS_FIRST_DIRECTIVE_STRING_H = @NEXT_AS_FIRST_DIRECTIVE_STRING_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_IOCTL_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_IOCTL_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_SOCKET_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_SOCKET_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H@
+NEXT_AS_FIRST_DIRECTIVE_TIME_H = @NEXT_AS_FIRST_DIRECTIVE_TIME_H@
+NEXT_AS_FIRST_DIRECTIVE_UNISTD_H = @NEXT_AS_FIRST_DIRECTIVE_UNISTD_H@
+NEXT_AS_FIRST_DIRECTIVE_WCHAR_H = @NEXT_AS_FIRST_DIRECTIVE_WCHAR_H@
+NEXT_ERRNO_H = @NEXT_ERRNO_H@
+NEXT_FLOAT_H = @NEXT_FLOAT_H@
+NEXT_NETDB_H = @NEXT_NETDB_H@
+NEXT_NETINET_IN_H = @NEXT_NETINET_IN_H@
+NEXT_STDARG_H = @NEXT_STDARG_H@
+NEXT_STDDEF_H = @NEXT_STDDEF_H@
+NEXT_STDINT_H = @NEXT_STDINT_H@
+NEXT_STDIO_H = @NEXT_STDIO_H@
+NEXT_STDLIB_H = @NEXT_STDLIB_H@
+NEXT_STRING_H = @NEXT_STRING_H@
+NEXT_SYS_IOCTL_H = @NEXT_SYS_IOCTL_H@
+NEXT_SYS_SELECT_H = @NEXT_SYS_SELECT_H@
+NEXT_SYS_SOCKET_H = @NEXT_SYS_SOCKET_H@
+NEXT_SYS_STAT_H = @NEXT_SYS_STAT_H@
+NEXT_SYS_TIME_H = @NEXT_SYS_TIME_H@
+NEXT_TIME_H = @NEXT_TIME_H@
+NEXT_UNISTD_H = @NEXT_UNISTD_H@
+NEXT_WCHAR_H = @NEXT_WCHAR_H@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PMCCABE = @PMCCABE@
+PRAGMA_SYSTEM_HEADER = @PRAGMA_SYSTEM_HEADER@
+PTHREAD_H_DEFINES_STRUCT_TIMESPEC = @PTHREAD_H_DEFINES_STRUCT_TIMESPEC@
+PTRDIFF_T_SUFFIX = @PTRDIFF_T_SUFFIX@
+RANLIB = @RANLIB@
+REPLACE_BTOWC = @REPLACE_BTOWC@
+REPLACE_CANONICALIZE_FILE_NAME = @REPLACE_CANONICALIZE_FILE_NAME@
+REPLACE_CHOWN = @REPLACE_CHOWN@
+REPLACE_CLOSE = @REPLACE_CLOSE@
+REPLACE_DPRINTF = @REPLACE_DPRINTF@
+REPLACE_DUP = @REPLACE_DUP@
+REPLACE_DUP2 = @REPLACE_DUP2@
+REPLACE_FCHOWNAT = @REPLACE_FCHOWNAT@
+REPLACE_FCLOSE = @REPLACE_FCLOSE@
+REPLACE_FFLUSH = @REPLACE_FFLUSH@
+REPLACE_FOPEN = @REPLACE_FOPEN@
+REPLACE_FPRINTF = @REPLACE_FPRINTF@
+REPLACE_FPURGE = @REPLACE_FPURGE@
+REPLACE_FREOPEN = @REPLACE_FREOPEN@
+REPLACE_FSEEK = @REPLACE_FSEEK@
+REPLACE_FSEEKO = @REPLACE_FSEEKO@
+REPLACE_FSTAT = @REPLACE_FSTAT@
+REPLACE_FSTATAT = @REPLACE_FSTATAT@
+REPLACE_FTELL = @REPLACE_FTELL@
+REPLACE_FTELLO = @REPLACE_FTELLO@
+REPLACE_FUTIMENS = @REPLACE_FUTIMENS@
+REPLACE_GETCWD = @REPLACE_GETCWD@
+REPLACE_GETDELIM = @REPLACE_GETDELIM@
+REPLACE_GETGROUPS = @REPLACE_GETGROUPS@
+REPLACE_GETLINE = @REPLACE_GETLINE@
+REPLACE_GETPAGESIZE = @REPLACE_GETPAGESIZE@
+REPLACE_GETTIMEOFDAY = @REPLACE_GETTIMEOFDAY@
+REPLACE_IOCTL = @REPLACE_IOCTL@
+REPLACE_LCHOWN = @REPLACE_LCHOWN@
+REPLACE_LINK = @REPLACE_LINK@
+REPLACE_LINKAT = @REPLACE_LINKAT@
+REPLACE_LOCALTIME_R = @REPLACE_LOCALTIME_R@
+REPLACE_LSEEK = @REPLACE_LSEEK@
+REPLACE_LSTAT = @REPLACE_LSTAT@
+REPLACE_MBRLEN = @REPLACE_MBRLEN@
+REPLACE_MBRTOWC = @REPLACE_MBRTOWC@
+REPLACE_MBSINIT = @REPLACE_MBSINIT@
+REPLACE_MBSNRTOWCS = @REPLACE_MBSNRTOWCS@
+REPLACE_MBSRTOWCS = @REPLACE_MBSRTOWCS@
+REPLACE_MBSTATE_T = @REPLACE_MBSTATE_T@
+REPLACE_MEMCHR = @REPLACE_MEMCHR@
+REPLACE_MEMMEM = @REPLACE_MEMMEM@
+REPLACE_MKDIR = @REPLACE_MKDIR@
+REPLACE_MKFIFO = @REPLACE_MKFIFO@
+REPLACE_MKNOD = @REPLACE_MKNOD@
+REPLACE_MKSTEMP = @REPLACE_MKSTEMP@
+REPLACE_MKTIME = @REPLACE_MKTIME@
+REPLACE_NANOSLEEP = @REPLACE_NANOSLEEP@
+REPLACE_NULL = @REPLACE_NULL@
+REPLACE_OBSTACK_PRINTF = @REPLACE_OBSTACK_PRINTF@
+REPLACE_PERROR = @REPLACE_PERROR@
+REPLACE_POPEN = @REPLACE_POPEN@
+REPLACE_PREAD = @REPLACE_PREAD@
+REPLACE_PRINTF = @REPLACE_PRINTF@
+REPLACE_PUTENV = @REPLACE_PUTENV@
+REPLACE_PWRITE = @REPLACE_PWRITE@
+REPLACE_READLINK = @REPLACE_READLINK@
+REPLACE_REALPATH = @REPLACE_REALPATH@
+REPLACE_REMOVE = @REPLACE_REMOVE@
+REPLACE_RENAME = @REPLACE_RENAME@
+REPLACE_RENAMEAT = @REPLACE_RENAMEAT@
+REPLACE_RMDIR = @REPLACE_RMDIR@
+REPLACE_SELECT = @REPLACE_SELECT@
+REPLACE_SETENV = @REPLACE_SETENV@
+REPLACE_SLEEP = @REPLACE_SLEEP@
+REPLACE_SNPRINTF = @REPLACE_SNPRINTF@
+REPLACE_SPRINTF = @REPLACE_SPRINTF@
+REPLACE_STAT = @REPLACE_STAT@
+REPLACE_STDIO_WRITE_FUNCS = @REPLACE_STDIO_WRITE_FUNCS@
+REPLACE_STPNCPY = @REPLACE_STPNCPY@
+REPLACE_STRCASESTR = @REPLACE_STRCASESTR@
+REPLACE_STRDUP = @REPLACE_STRDUP@
+REPLACE_STRERROR = @REPLACE_STRERROR@
+REPLACE_STRNCAT = @REPLACE_STRNCAT@
+REPLACE_STRNDUP = @REPLACE_STRNDUP@
+REPLACE_STRNLEN = @REPLACE_STRNLEN@
+REPLACE_STRSIGNAL = @REPLACE_STRSIGNAL@
+REPLACE_STRSTR = @REPLACE_STRSTR@
+REPLACE_STRTOD = @REPLACE_STRTOD@
+REPLACE_STRTOK_R = @REPLACE_STRTOK_R@
+REPLACE_SYMLINK = @REPLACE_SYMLINK@
+REPLACE_TIMEGM = @REPLACE_TIMEGM@
+REPLACE_TMPFILE = @REPLACE_TMPFILE@
+REPLACE_TTYNAME_R = @REPLACE_TTYNAME_R@
+REPLACE_UNLINK = @REPLACE_UNLINK@
+REPLACE_UNLINKAT = @REPLACE_UNLINKAT@
+REPLACE_UNSETENV = @REPLACE_UNSETENV@
+REPLACE_USLEEP = @REPLACE_USLEEP@
+REPLACE_UTIMENSAT = @REPLACE_UTIMENSAT@
+REPLACE_VASPRINTF = @REPLACE_VASPRINTF@
+REPLACE_VDPRINTF = @REPLACE_VDPRINTF@
+REPLACE_VFPRINTF = @REPLACE_VFPRINTF@
+REPLACE_VPRINTF = @REPLACE_VPRINTF@
+REPLACE_VSNPRINTF = @REPLACE_VSNPRINTF@
+REPLACE_VSPRINTF = @REPLACE_VSPRINTF@
+REPLACE_WCRTOMB = @REPLACE_WCRTOMB@
+REPLACE_WCSNRTOMBS = @REPLACE_WCSNRTOMBS@
+REPLACE_WCSRTOMBS = @REPLACE_WCSRTOMBS@
+REPLACE_WCTOB = @REPLACE_WCTOB@
+REPLACE_WCWIDTH = @REPLACE_WCWIDTH@
+REPLACE_WRITE = @REPLACE_WRITE@
+SED = @SED@
+SERVENT_LIB = @SERVENT_LIB@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SIG_ATOMIC_T_SUFFIX = @SIG_ATOMIC_T_SUFFIX@
+SIZE_T_SUFFIX = @SIZE_T_SUFFIX@
+STDARG_H = @STDARG_H@
+STDBOOL_H = @STDBOOL_H@
+STDDEF_H = @STDDEF_H@
+STDINT_H = @STDINT_H@
+STRIP = @STRIP@
+SYS_IOCTL_H_HAVE_WINSOCK2_H = @SYS_IOCTL_H_HAVE_WINSOCK2_H@
+SYS_IOCTL_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS = @SYS_IOCTL_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS@
+SYS_TIME_H_DEFINES_STRUCT_TIMESPEC = @SYS_TIME_H_DEFINES_STRUCT_TIMESPEC@
+TIME_H_DEFINES_STRUCT_TIMESPEC = @TIME_H_DEFINES_STRUCT_TIMESPEC@
+UNDEFINE_STRTOK_R = @UNDEFINE_STRTOK_R@
+UNISTD_H_HAVE_WINSOCK2_H = @UNISTD_H_HAVE_WINSOCK2_H@
+UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS = @UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS@
+VALGRIND = @VALGRIND@
+VERSION = @VERSION@
+WARN_CFLAGS = @WARN_CFLAGS@
+WCHAR_T_SUFFIX = @WCHAR_T_SUFFIX@
+WERROR_CFLAGS = @WERROR_CFLAGS@
+WINT_T_SUFFIX = @WINT_T_SUFFIX@
+WSTACK_CFLAGS = @WSTACK_CFLAGS@
+abs_aux_dir = @abs_aux_dir@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_CXX = @ac_ct_CXX@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+gl_LIBOBJS = @gl_LIBOBJS@
+gl_LTLIBOBJS = @gl_LTLIBOBJS@
+gltests_LIBOBJS = @gltests_LIBOBJS@
+gltests_LTLIBOBJS = @gltests_LTLIBOBJS@
+gltests_WITNESS = @gltests_WITNESS@
+guile_snarf = @guile_snarf@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+subdirs = @subdirs@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
+AM_CPPFLAGS = \
+	      	-I$(top_srcdir)/lib/includes		\
+			-I$(top_builddir)/lib/includes
+
+AM_LDFLAGS = -no-install
+LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7
+TESTS_ENVIRONMENT = $(VALGRIND)
+EXTRA_DIST = README params.dh
+dist_check_SCRIPTS = testsrn
+all: all-am
+
+.SUFFIXES:
+	.SUFFIXES: .c .lo .o .obj
+	$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+		case '$(am__configure_deps)' in \
+		*$$dep*) \
+		( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+		&& { if test -f $@; then exit 0; else break; fi; }; \
+		exit 1;; \
+		esac; \
+		done; \
+		echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile'; \
+		$(am__cd) $(top_srcdir) && \
+		$(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile
+	.PRECIOUS: Makefile
+	Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+		*config.status*) \
+		cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+		*) \
+		echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+		cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+		esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+		cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+		cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+		cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+clean-checkPROGRAMS:
+		@list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \
+				echo " rm -f" $$list; \
+					rm -f $$list || exit $$?; \
+						test -n "$(EXEEXT)" || exit 0; \
+							list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
+								echo " rm -f" $$list; \
+									rm -f $$list
+		srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) 
+			@rm -f srn0$(EXEEXT)
+				$(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS)
+srn1$(EXEEXT): $(srn1_OBJECTS) $(srn1_DEPENDENCIES) 
+		@rm -f srn1$(EXEEXT)
+			$(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS)
+srn2$(EXEEXT): $(srn2_OBJECTS) $(srn2_DEPENDENCIES) 
+		@rm -f srn2$(EXEEXT)
+			$(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS)
+srn3$(EXEEXT): $(srn3_OBJECTS) $(srn3_DEPENDENCIES) 
+		@rm -f srn3$(EXEEXT)
+			$(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS)
+srn4$(EXEEXT): $(srn4_OBJECTS) $(srn4_DEPENDENCIES) 
+		@rm -f srn4$(EXEEXT)
+			$(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS)
+srn5$(EXEEXT): $(srn5_OBJECTS) $(srn5_DEPENDENCIES) 
+		@rm -f srn5$(EXEEXT)
+			$(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS)
+srn6$(EXEEXT): $(srn6_OBJECTS) $(srn6_DEPENDENCIES) 
+		@rm -f srn6$(EXEEXT)
+			$(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS)
+srn7$(EXEEXT): $(srn7_OBJECTS) $(srn7_DEPENDENCIES) 
+		@rm -f srn7$(EXEEXT)
+			$(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS)
+
+mostlyclean-compile:
+		-rm -f *.$(OBJEXT)
+
+distclean-compile:
+		-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn0.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn1.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn2.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn3.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn4.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn5.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn6.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn7.Po@am__quote@
+
+.c.o:
+	@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+	@am__fastdepCC_FALSE@	$(COMPILE) -c $<
+
+.c.obj:
+	@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+	@am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
+
+.c.lo:
+	@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+	@am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+	     unique=`for i in $$list; do \
+	     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	     done | \
+	     $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+	     END { if (nonempty) { for (i in files) print i; }; }'`; \
+	     mkid -fID $$unique
+	tags: TAGS
+
+TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+	$(TAGS_FILES) $(LISP)
+	set x; \
+		here=`pwd`; \
+		list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+		unique=`for i in $$list; do \
+		if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+		done | \
+		$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+		END { if (nonempty) { for (i in files) print i; }; }'`; \
+		shift; \
+		if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+		test -n "$$unique" || unique=$$empty_fix; \
+		if test $$# -gt 0; then \
+		$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+		"$$@" $$unique; \
+		else \
+		$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+		$$unique; \
+		fi; \
+		fi
+	ctags: CTAGS
+	CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	     unique=`for i in $$list; do \
+	     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	     done | \
+	     $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
+	     END { if (nonempty) { for (i in files) print i; }; }'`; \
+	     test -z "$(CTAGS_ARGS)$$unique" \
+	     || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	     && $(am__cd) $(top_srcdir) \
+	     && gtags -i $(GTAGS_ARGS) "$$here"
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+check-TESTS: $(TESTS)
+	@failed=0; all=0; xfail=0; xpass=0; skip=0; \
+		srcdir=$(srcdir); export srcdir; \
+		list=' $(TESTS) '; \
+		$(am__tty_colors); \
+		if test -n "$$list"; then \
+		for tst in $$list; do \
+		if test -f ./$$tst; then dir=./; \
+		elif test -f $$tst; then dir=; \
+		else dir="$(srcdir)/"; fi; \
+		if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
+		all=`expr $$all + 1`; \
+		case " $(XFAIL_TESTS) " in \
+		*[\ \	]$$tst[\ \	]*) \
+		xpass=`expr $$xpass + 1`; \
+		failed=`expr $$failed + 1`; \
+		col=$$red; res=XPASS; \
+		;; \
+		*) \
+		col=$$grn; res=PASS; \
+		;; \
+		esac; \
+		elif test $$? -ne 77; then \
+		all=`expr $$all + 1`; \
+		case " $(XFAIL_TESTS) " in \
+		*[\ \	]$$tst[\ \	]*) \
+		xfail=`expr $$xfail + 1`; \
+		col=$$lgn; res=XFAIL; \
+		;; \
+		*) \
+		failed=`expr $$failed + 1`; \
+		col=$$red; res=FAIL; \
+		;; \
+		esac; \
+		else \
+		skip=`expr $$skip + 1`; \
+		col=$$blu; res=SKIP; \
+		fi; \
+		echo "$${col}$$res$${std}: $$tst"; \
+		done; \
+		if test "$$all" -eq 1; then \
+		tests="test"; \
+		All=""; \
+		else \
+		tests="tests"; \
+		All="All "; \
+		fi; \
+		if test "$$failed" -eq 0; then \
+		if test "$$xfail" -eq 0; then \
+		banner="$$All$$all $$tests passed"; \
+		else \
+		if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \
+		banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \
+		fi; \
+		else \
+		if test "$$xpass" -eq 0; then \
+		banner="$$failed of $$all $$tests failed"; \
+		else \
+		if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \
+		banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \
+		fi; \
+		fi; \
+		dashes="$$banner"; \
+		skipped=""; \
+		if test "$$skip" -ne 0; then \
+		if test "$$skip" -eq 1; then \
+		skipped="($$skip test was not run)"; \
+		else \
+		skipped="($$skip tests were not run)"; \
+		fi; \
+		test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
+		dashes="$$skipped"; \
+		fi; \
+		report=""; \
+		if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \
+		report="Please report to $(PACKAGE_BUGREPORT)"; \
+		test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \
+		dashes="$$report"; \
+		fi; \
+		dashes=`echo "$$dashes" | sed s/./=/g`; \
+		if test "$$failed" -eq 0; then \
+		echo "$$grn$$dashes"; \
+		else \
+		echo "$$red$$dashes"; \
+		fi; \
+		echo "$$banner"; \
+		test -z "$$skipped" || echo "$$skipped"; \
+		test -z "$$report" || echo "$$report"; \
+		echo "$$dashes$$std"; \
+		test "$$failed" -eq 0; \
+		else :; fi
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+		topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+		list='$(DISTFILES)'; \
+		dist_files=`for file in $$list; do echo $$file; done | \
+		sed -e "s|^$$srcdirstrip/||;t" \
+		-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+		case $$dist_files in \
+		*/*) $(MKDIR_P) `echo "$$dist_files" | \
+		sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+		sort -u` ;; \
+		esac; \
+		for file in $$dist_files; do \
+		if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+		if test -d $$d/$$file; then \
+		dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+		if test -d "$(distdir)/$$file"; then \
+		find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+		fi; \
+		if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+		cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+		find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+		fi; \
+		cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+		else \
+		test -f "$(distdir)/$$file" \
+		|| cp -p $$d/$$file "$(distdir)/$$file" \
+		|| exit 1; \
+		fi; \
+		done
+	check-am: all-am
+	$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) \
+		$(dist_check_SCRIPTS)
+	$(MAKE) $(AM_MAKEFLAGS) check-TESTS
+	check: check-am
+	all-am: Makefile
+installdirs:
+	install: install-am
+	install-exec: install-exec-am
+	install-data: install-data-am
+	uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+	install-strip:
+	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+		install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+		`test -z '$(STRIP)' || \
+		echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+	mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+	clean: clean-am
+
+clean-am: clean-checkPROGRAMS clean-generic clean-libtool \
+	mostlyclean-am
+
+distclean: distclean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+	distclean-am: clean-am distclean-compile distclean-generic \
+		distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -rf ./$(DEPDIR)
+	-rm -f Makefile
+	maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: check-am install-am install-strip
+
+.PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \
+	clean-checkPROGRAMS clean-generic clean-libtool ctags \
+	distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-compile \
+	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+	tags uninstall uninstall-am
+
+#TESTS = testsrn
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# # Otherwise a system limit (for SysV at least) may be exceeded.
+# .NOEXPORT:
Index: gnutls-2.4.1/tests/safe-renegotiation/README
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/README
@@ -0,0 +1,93 @@
+Testing safe renegotiation is relatively complex, here is a summary of
+what we test and what how we believe it should work.
+
+	Client setting
+			Server setting
+					Initial handshake outcome
+							Rehandshake outcome
+srn0.c
+
+ This tests that the safe renegotiation extension is negotiated
+ properly by default on initial connections and on rehandshaked
+ connections.  Consequently, it also verifies that rehandshaked
+ connections work with the extension enabled.
+
+	NORMAL
+			NORMAL
+					OK
+							OK
+
+srn1.c
+
+ This tests that clients without support for safe renegotiation is
+ able to handshake against servers with support, but not able to
+ rehandshake (server will refuse rehandshake).
+
+	NORMAL:%DISABLE_SAFE_RENEGOTIATION
+			NORMAL
+					OK
+							Server refuses
+
+srn2.c
+
+ This tests that clients with support for safe renegotiation is able
+ to handshake against servers without support, but not able to
+ rehandshake (client will refuse rehandshake).
+
+	NORMAL
+			NORMAL:%DISABLE_SAFE_RENEGOTIATION
+					OK
+							Client refuses
+
+srn3.c
+
+ This tests that a %SAFE_RENEGOTIATION client will reject handshakes
+ against servers that do not support the extension (server uses
+ %DISABLE_SAFE_RENEGOTIATION).
+
+	NORMAL:%SAFE_RENEGOTIATION
+			NORMAL:%DISABLE_SAFE_RENEGOTIATION
+					Client refuses
+							N/A
+
+srn4.c
+
+ This tests that a %SAFE_RENEGOTIATION server will reject handshakes
+ against clients that do not support the extension.
+
+	NORMAL:%DISABLE_SAFE_RENEGOTIATION
+			NORMAL:%SAFE_RENEGOTIATION
+					Server refuses
+							N/A
+
+srn5.c
+
+ This tests that a client with a permissive policy
+ (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
+ server with no support for the extension.
+
+	NORMAL:%DISABLE_SAFE_RENEGOTIATION
+			NORMAL:%UNSAFE_RENEGOTIATION
+					OK
+							OK
+
+srn6.c
+
+ This tests that a server with a permissive policy
+ (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
+ client with no support for the extension.
+
+	NORMAL:%UNSAFE_RENEGOTIATION
+			NORMAL:%DISABLE_SAFE_RENEGOTIATION
+					OK
+							OK
+
+srn7.c
+
+ This tests that clients and servers in %SAFE_RENEGOTIATION mode are
+ able to handshake and rehandshake.
+
+	NORMAL:%SAFE_RENEGOTIATION
+			NORMAL:%SAFE_RENEGOTIATION
+					OK
+							OK
Index: gnutls-2.4.1/tests/safe-renegotiation/params.dh
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/params.dh
@@ -0,0 +1,35 @@
+
+Generator: 05
+
+Prime: c9:e9:2d:fc:94:15:1a:10:4f:3c:b5:16
+       7e:34:10:7d:eb:3d:d5:7d:61:ff:b0:ce
+       da:7f:6e:0c:ea:db:b4:87:f6:c6:34:a8
+       3c:f8:84:52:14:59:ab:17:5c:d0:f0:86
+       c4:02:93:dc:09:83:57:16:98:21:d0:42
+       8e:33:fc:48:69:e6:04:0d:4e:50:09:33
+       2e:28:60:4f:05:08:7c:ce:2f:a6:1a:4c
+       41:d1:a3:dd:f6:37:56:44:1d:b0:54:af
+       f7:4a:a0:c2:19:5d:ce:62:b0:7a:1b:e1
+       5c:7f:bb:4d:7e:9e:28:48:00:a4:9a:86
+       3e:6e:6e:9c:57:41:c7:ec:bf:7f:09:fc
+       da:25:c2:1e:e0:52:dc:65:8c:40:a3:6e
+       bd:99:4e:0b:1a:04:e0:23:20:46:5a:d0
+       3f:b3:a4:d6:76:73:b7:cc:61:33:11:54
+       a6:32:ff:94:08:d5:66:36:fd:99:69:21
+       cc:28:5d:11:52:32:48:b6:a5:b5:c3:b0
+       21:3f:f9:69:25:83:b1:3d:79:a6:ed:ae
+       db:95:62:fc:72:ca:ad:46:fc:b6:b1:ea
+       98:68:97:ba:f2:54:aa:86:ed:62:b1:78
+       5f:d5:19:80:ce:41:ee:98:a1:71:9f:fa
+       5b:6b:d8:5e:7e:b3:18:0a:f0:4c:96:76
+       6c:0c:b0:a3
+
+
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAyekt/JQVGhBPPLUWfjQQfes91X1h/7DO2n9uDOrbtIf2xjSoPPiE
+UhRZqxdc0PCGxAKT3AmDVxaYIdBCjjP8SGnmBA1OUAkzLihgTwUIfM4vphpMQdGj
+3fY3VkQdsFSv90qgwhldzmKwehvhXH+7TX6eKEgApJqGPm5unFdBx+y/fwn82iXC
+HuBS3GWMQKNuvZlOCxoE4CMgRlrQP7Ok1nZzt8xhMxFUpjL/lAjVZjb9mWkhzChd
+EVIySLaltcOwIT/5aSWDsT15pu2u25Vi/HLKrUb8trHqmGiXuvJUqobtYrF4X9UZ
+gM5B7pihcZ/6W2vYXn6zGArwTJZ2bAywowIBBQ==
+-----END DH PARAMETERS-----
Index: gnutls-2.4.1/tests/safe-renegotiation/srn0.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn0.c
@@ -0,0 +1,338 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ../mini-x509-rehandshake.c.
+ *
+ * This tests that the safe renegotiation extension is negotiated
+ * properly by default on initial connections and on rehandshaked
+ * connections.  Consequently, it also verifies that rehandshaked
+ * connections work with the extension enabled.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL", NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL", NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (!gnutls_safe_renegotiation_status (client) ||
+			!gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session not using safe renegotiation!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = 1;
+
+	if (!gnutls_safe_renegotiation_status (client) ||
+			!gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0,
+				"Rehandshaked session not using safe renegotiation!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ./srn0.c.
+ *
+ * This tests that clients without support for safe renegotiation is
+ * able to handshake against servers with support, but not able to
+ * rehandshake (server will refuse rehandshake).
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL", NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session using safe renegotiation but shouldn't?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED)
+			break;
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS
+			&& sret != GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED)
+		exit_code = 1;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Rehandshaked worked and uses safe reneg?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn2.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn2.c
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ./srn1.c.
+ *
+ * This tests that clients with support for safe renegotiation is able
+ * to handshake against servers without support, but not able to
+ * rehandshake (client will refuse rehandshake).
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL", NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session using safe renegotiation but shouldn't?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (cret == GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED)
+			break;
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED
+			&& sret != GNUTLS_E_SUCCESS)
+		exit_code = 1;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Rehandshaked worked and uses safe reneg?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn3.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn3.c
@@ -0,0 +1,264 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ../mini-x509.c.
+ *
+ * This tests that a %SAFE_RENEGOTIATION client will reject handshakes
+ * against servers that do not support the extension (server uses
+ * %DISABLE_SAFE_RENEGOTIATION).
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%SAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while ((cret == GNUTLS_E_AGAIN || cret == GNUTLS_E_SUCCESS)
+			&& (sret == GNUTLS_E_AGAIN || sret == GNUTLS_E_SUCCESS));
+
+	if (cret != GNUTLS_E_SAFE_RENEGOTIATION_FAILED && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn4.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn4.c
@@ -0,0 +1,263 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ../mini-x509.c.
+ *
+ * This tests that a %SAFE_RENEGOTIATION server will reject handshakes
+ * against clients that do not support the extension.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%SAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while ((cret == GNUTLS_E_AGAIN || cret == GNUTLS_E_SUCCESS)
+			&& (sret == GNUTLS_E_AGAIN || sret == GNUTLS_E_SUCCESS));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SAFE_RENEGOTIATION_FAILED)
+		exit_code = EXIT_FAILURE;
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn5.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn5.c
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ./srn0.c.
+ *
+ * This tests that a client with a permissive policy
+ * (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
+ * server with no support for the extension.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%UNSAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session using safe renegotiation?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = 1;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Rehandshaked using safe renegotiation?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn6.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn6.c
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ./srn5.c.
+ *
+ * This tests that a server with a permissive policy
+ * (%UNSAFE_RENEGOTIATION) is able to handshake and rehandshake with a
+ * client with no support for the extension.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%UNSAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%DISABLE_SAFE_RENEGOTIATION",
+			NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session using safe renegotiation?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = 1;
+
+	if (gnutls_safe_renegotiation_status (client) ||
+			gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Rehandshaked using safe renegotiation?!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/srn7.c
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/srn7.c
@@ -0,0 +1,336 @@
+/*
+ * Copyright (C) 2008, 2010 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+/* Code based on ../srn0.c.
+ *
+ * This tests that clients and servers in %SAFE_RENEGOTIATION mode are
+ * able to handshake and rehandshake.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+
+	static void
+tls_log_func (int level, const char *str)
+{
+	fprintf (stderr, "|<%d>| %s", level, str);
+}
+
+static char *to_server;
+static size_t to_server_len;
+
+static char *to_client;
+static size_t to_client_len;
+
+	static ssize_t
+client_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_client_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_client, len);
+
+	memmove (to_client, to_client + len, to_client_len - len);
+	to_client_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+client_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_server_len + len;
+	char *tmp;
+
+	tmp = realloc (to_server, newlen);
+	if (!tmp)
+		abort ();
+	to_server = tmp;
+
+	memcpy (to_server + to_server_len, data, len);
+	to_server_len = newlen;
+
+	return len;
+}
+
+	static ssize_t
+server_pull (gnutls_transport_ptr_t tr, void *data, size_t len)
+{
+	if (to_server_len < len)
+	{
+		gnutls_transport_set_global_errno (EAGAIN);
+		return -1;
+	}
+
+	memcpy (data, to_server, len);
+
+	memmove (to_server, to_server + len, to_server_len - len);
+	to_server_len -= len;
+
+	return len;
+}
+
+	static ssize_t
+server_push (gnutls_transport_ptr_t tr, const void *data, size_t len)
+{
+	size_t newlen = to_client_len + len;
+	char *tmp;
+
+	tmp = realloc (to_client, newlen);
+	if (!tmp)
+		abort ();
+	to_client = tmp;
+
+	memcpy (to_client + to_client_len, data, len);
+	to_client_len = newlen;
+
+	return len;
+}
+
+static unsigned char server_cert_pem[] =
+"-----BEGIN CERTIFICATE-----\n"
+"MIICVjCCAcGgAwIBAgIERiYdMTALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n"
+"VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTIxWhcNMDgwNDE3MTMyOTIxWjA3MRsw\n"
+"GQYDVQQKExJHbnVUTFMgdGVzdCBzZXJ2ZXIxGDAWBgNVBAMTD3Rlc3QuZ251dGxz\n"
+"Lm9yZzCBnDALBgkqhkiG9w0BAQEDgYwAMIGIAoGA17pcr6MM8C6pJ1aqU46o63+B\n"
+"dUxrmL5K6rce+EvDasTaDQC46kwTHzYWk95y78akXrJutsoKiFV1kJbtple8DDt2\n"
+"DZcevensf9Op7PuFZKBroEjOd35znDET/z3IrqVgbtm2jFqab7a+n2q9p/CgMyf1\n"
+"tx2S5Zacc1LWn9bIjrECAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQT\n"
+"MBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8B\n"
+"Af8EBQMDB6AAMB0GA1UdDgQWBBTrx0Vu5fglyoyNgw106YbU3VW0dTAfBgNVHSME\n"
+"GDAWgBTpPBz7rZJu5gakViyi4cBTJ8jylTALBgkqhkiG9w0BAQUDgYEAaFEPTt+7\n"
+"bzvBuOf7+QmeQcn29kT6Bsyh1RHJXf8KTk5QRfwp6ogbp94JQWcNQ/S7YDFHglD1\n"
+"AwUNBRXwd3riUsMnsxgeSDxYBfJYbDLeohNBsqaPDJb7XailWbMQKfAbFQ8cnOxg\n"
+"rOKLUQRWJ0K3HyXRMhbqjdLIaQiCvQLuizo=\n" "-----END CERTIFICATE-----\n";
+
+const gnutls_datum_t server_cert = { server_cert_pem,
+	sizeof (server_cert_pem)
+};
+
+static unsigned char server_key_pem[] =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIICXAIBAAKBgQDXulyvowzwLqknVqpTjqjrf4F1TGuYvkrqtx74S8NqxNoNALjq\n"
+"TBMfNhaT3nLvxqResm62ygqIVXWQlu2mV7wMO3YNlx696ex/06ns+4VkoGugSM53\n"
+"fnOcMRP/PciupWBu2baMWppvtr6far2n8KAzJ/W3HZLllpxzUtaf1siOsQIDAQAB\n"
+"AoGAYAFyKkAYC/PYF8e7+X+tsVCHXppp8AoP8TEZuUqOZz/AArVlle/ROrypg5kl\n"
+"8YunrvUdzH9R/KZ7saNZlAPLjZyFG9beL/am6Ai7q7Ma5HMqjGU8kTEGwD7K+lbG\n"
+"iomokKMOl+kkbY/2sI5Czmbm+/PqLXOjtVc5RAsdbgvtmvkCQQDdV5QuU8jap8Hs\n"
+"Eodv/tLJ2z4+SKCV2k/7FXSKWe0vlrq0cl2qZfoTUYRnKRBcWxc9o92DxK44wgPi\n"
+"oMQS+O7fAkEA+YG+K9e60sj1K4NYbMPAbYILbZxORDecvP8lcphvwkOVUqbmxOGh\n"
+"XRmTZUuhBrJhJKKf6u7gf3KWlPl6ShKEbwJASC118cF6nurTjuLf7YKARDjNTEws\n"
+"qZEeQbdWYINAmCMj0RH2P0mvybrsXSOD5UoDAyO7aWuqkHGcCLv6FGG+qwJAOVqq\n"
+"tXdUucl6GjOKKw5geIvRRrQMhb/m5scb+5iw8A4LEEHPgGiBaF5NtJZLALgWfo5n\n"
+"hmC8+G8F0F78znQtPwJBANexu+Tg5KfOnzSILJMo3oXiXhf5PqXIDmbN0BKyCKAQ\n"
+"LfkcEcUbVfmDaHpvzwY9VEaoMOKVLitETXdNSxVpvWM=\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+const gnutls_datum_t server_key = { server_key_pem,
+	sizeof (server_key_pem)
+};
+
+	int
+main (int argc, char *argv[])
+{
+	int debug_level = argc - 1;
+	int exit_code = EXIT_SUCCESS;
+	/* Server stuff. */
+	gnutls_certificate_credentials_t serverx509cred;
+	gnutls_session_t server;
+	int sret = GNUTLS_E_AGAIN;
+	/* Client stuff. */
+	gnutls_certificate_credentials_t clientx509cred;
+	gnutls_session_t client;
+	int cret = GNUTLS_E_AGAIN;
+
+	/* General init. */
+	gnutls_global_init ();
+	gnutls_global_set_log_function (tls_log_func);
+	gnutls_global_set_log_level (debug_level);
+
+	/* Init server */
+	gnutls_certificate_allocate_credentials (&serverx509cred);
+	gnutls_certificate_set_x509_key_mem (serverx509cred,
+			&server_cert, &server_key,
+			GNUTLS_X509_FMT_PEM);
+	gnutls_init (&server, GNUTLS_SERVER);
+	gnutls_credentials_set (server, GNUTLS_CRD_CERTIFICATE, serverx509cred);
+	gnutls_priority_set_direct (server, "NORMAL:%SAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (server, server_push);
+	gnutls_transport_set_pull_function (server, server_pull);
+
+	/* Init client */
+	gnutls_certificate_allocate_credentials (&clientx509cred);
+	gnutls_init (&client, GNUTLS_CLIENT);
+	gnutls_credentials_set (client, GNUTLS_CRD_CERTIFICATE, clientx509cred);
+	gnutls_priority_set_direct (client, "NORMAL:%SAFE_RENEGOTIATION", NULL);
+	gnutls_transport_set_push_function (client, client_push);
+	gnutls_transport_set_pull_function (client, client_pull);
+
+	/* Check that initially no session use the extension. */
+	if (gnutls_safe_renegotiation_status (server)
+			|| gnutls_safe_renegotiation_status (client))
+	{
+		puts ("Client or server using extension before handshake?");
+		abort ();
+	}
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = EXIT_FAILURE;
+
+	if (!gnutls_safe_renegotiation_status (client) ||
+			!gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0, "Session not using safe renegotiation!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	sret = gnutls_rehandshake (server);
+	if (debug_level > 0)
+	{
+		tls_log_func (0, "gnutls_rehandshake (server)...\n");
+		tls_log_func (0, gnutls_strerror (sret));
+		tls_log_func (0, "\n");
+	}
+
+	{
+		ssize_t n;
+		char b[1];
+		n = gnutls_record_recv (client, b, 1);
+		if (n != GNUTLS_E_REHANDSHAKE)
+			abort ();
+	}
+
+	cret = GNUTLS_E_AGAIN;
+	sret = GNUTLS_E_AGAIN;
+
+	do
+	{
+		static int max_iter = 0;
+		if (max_iter++ > 10)
+			abort ();
+
+		if (cret == GNUTLS_E_AGAIN)
+		{
+			cret = gnutls_handshake (client);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (client)...\n");
+				tls_log_func (0, gnutls_strerror (cret));
+				tls_log_func (0, "\n");
+			}
+		}
+
+		if (sret == GNUTLS_E_AGAIN)
+		{
+			sret = gnutls_handshake (server);
+			if (debug_level > 0)
+			{
+				tls_log_func (0, "second gnutls_handshake (server)...\n");
+				tls_log_func (0, gnutls_strerror (sret));
+				tls_log_func (0, "\n");
+			}
+		}
+	}
+	while (
+			/* Not done: */
+			!(cret == GNUTLS_E_SUCCESS && sret == GNUTLS_E_SUCCESS)
+			/* No error: */
+			&& (cret == GNUTLS_E_AGAIN || sret == GNUTLS_E_AGAIN));
+
+	if (cret != GNUTLS_E_SUCCESS && sret != GNUTLS_E_SUCCESS)
+		exit_code = 1;
+
+	if (!gnutls_safe_renegotiation_status (client) ||
+			!gnutls_safe_renegotiation_status (server))
+	{
+		tls_log_func (0,
+				"Rehandshaked session not using safe renegotiation!\n");
+		exit_code = EXIT_FAILURE;
+	}
+
+	gnutls_bye (client, GNUTLS_SHUT_RDWR);
+	gnutls_bye (server, GNUTLS_SHUT_RDWR);
+
+	gnutls_deinit (client);
+	gnutls_deinit (server);
+
+	free (to_server);
+	free (to_client);
+
+	gnutls_certificate_free_credentials (serverx509cred);
+
+	gnutls_global_deinit ();
+
+	if (debug_level > 0)
+	{
+		if (exit_code == 0)
+			puts ("Self-test successful");
+		else
+			puts ("Self-test failed");
+	}
+
+	return exit_code;
+}
Index: gnutls-2.4.1/tests/safe-renegotiation/testsrn
===================================================================
--- /dev/null
+++ gnutls-2.4.1/tests/safe-renegotiation/testsrn
@@ -0,0 +1,103 @@
+#!/bin/sh
+
+# Copyright (C) 2010 Free Software Foundation, Inc.
+#
+# Author: Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+srcdir="${srcdir:-.}"
+SERV="${SERV:-../../src/gnutls-serv$EXEEXT} -q"
+CLI="${CLI:-../../src/gnutls-cli$EXEEXT}"
+PORT="${PORT:-5558}"
+unset RETCODE
+
+fail() {
+   echo "Failure: $1" >&2
+   RETCODE=${RETCODE:-${2:-1}}
+}
+
+echo "Checking Safe renegotiation"
+
+$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%PARTIAL_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 &
+pid=$!
+
+# give the server a chance to initialize
+sleep 2
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NONE:+AES-128-CBC:+MD5:+SHA1:+VERS-SSL3.0:+ANON-DH:+COMP-NULL:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "0. Renegotiation should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "1. Safe rehandshake should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "2. Unsafe rehandshake should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "3. Unsafe negotiation should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \
+  fail "4. Unsafe renegotiation should have failed!"
+
+
+kill $pid
+wait
+
+$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 &
+pid=$!
+
+# give the server a chance to initialize
+sleep 2
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "5. Safe rehandshake should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "6. Unsafe rehandshake should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \
+  fail "7. Unsafe negotiation should have failed!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \
+  fail "8. Unsafe renegotiation should have failed!"
+
+kill $pid
+wait
+
+$SERV -p $PORT --echo --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION --dhparams $srcdir/params.dh >/dev/null 2>&1 &
+pid=$!
+
+# give the server a chance to initialize
+sleep 2
+
+$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 && \
+  fail "9. Initial connection should have failed!"
+
+$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%UNSAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "10. Unsafe connection should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "11. Unsafe negotiation should have succeeded!"
+
+$CLI -p $PORT 127.0.0.1 --rehandshake --priority NORMAL:+ANON-DH:%DISABLE_SAFE_RENEGOTIATION </dev/null >/dev/null 2>&1 || \
+  fail "12. Unsafe renegotiation should have succeeded!"
+
+kill $pid
+wait
+
+exit ${RETCODE:-0}
Index: gnutls-2.4.1/src/tests.c
===================================================================
--- gnutls-2.4.1.orig/src/tests.c
+++ gnutls-2.4.1/src/tests.c
@@ -192,8 +192,6 @@ test_export (gnutls_session_t session)
   sprintf(prio_str, "+ARCFOUR-40:+RSA-EXPORT:"ALL_COMP":"ALL_CERTTYPES":%s:"ALL_MACS":"ALL_KX":"REST, protocol_str);
   _gnutls_priority_set_direct (session, prio_str);
 
-  ADD_KX (session, GNUTLS_KX_RSA_EXPORT);
-  ADD_CIPHER (session, GNUTLS_CIPHER_ARCFOUR_40);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, xcred);
 
   ret = do_handshake (session);
Index: gnutls-2.4.1/configure.in
===================================================================
--- gnutls-2.4.1.orig/configure.in
+++ gnutls-2.4.1/configure.in
@@ -687,7 +687,7 @@ AC_CONFIG_FILES([Makefile po/Makefile.in
 	tests/Makefile tests/rsa-md5-collision/Makefile tests/userid/Makefile \
 	tests/pkcs1-padding/Makefile tests/pkcs8-decode/Makefile \
 	tests/pkcs12-decode/Makefile tests/pathlen/Makefile \
-	tests/key-id/Makefile tests/sha2/Makefile \
+	tests/key-id/Makefile tests/sha2/Makefile  tests/safe-renegotiation/Makefile \
 	tests/hostname-check/Makefile \
 	includes/Makefile includes/gnutls/gnutls.h \
 	lib/Makefile lib/minitasn1/Makefile lib/x509/Makefile \
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.am
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.am
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.am
@@ -18,12 +18,17 @@
 # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 
 AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
-AM_CPPFLAGS = \
-	      -I$(top_srcdir)/lib/includes            \
-	      -I$(top_builddir)/lib/includes
+#AM_CPPFLAGS = \
+#	      -I$(top_srcdir)/lib/includes            \
+#	      -I$(top_builddir)/lib/includes
+AM_CPPFLAGS = -I$(top_srcdir)/includes -I$(top_builddir)/includes       \
+	      -I$(top_srcdir)/tests
 
 AM_LDFLAGS = -no-install
-LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+#LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+LDADD = -L$(top_builddir)/libextra -lgnutls-extra       \
+	-L$(top_builddir)/lib      -lgnutls             \
+	-L$(top_builddir)/tests    -lutils
 
 ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7
 
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
@@ -879,12 +879,17 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
-AM_CPPFLAGS = \
-	      	-I$(top_srcdir)/lib/includes		\
-			-I$(top_builddir)/lib/includes
+#AM_CPPFLAGS = \
+#	      	-I$(top_srcdir)/lib/includes		\
+#			-I$(top_builddir)/lib/includes
+AM_CPPFLAGS = -I$(top_srcdir)/includes -I$(top_builddir)/includes       \
+	      -I$(top_srcdir)/tests
 
 AM_LDFLAGS = -no-install
-LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+#LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
+LDADD = -L$(top_builddir)/libextra -lgnutls-extra       \
+	-L$(top_builddir)/lib      -lgnutls             \
+	-L$(top_builddir)/tests    -lutils
 ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7
 TESTS_ENVIRONMENT = $(VALGRIND)
 EXTRA_DIST = README params.dh
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
@@ -58,138 +58,138 @@ DIST_COMMON = README $(dist_check_SCRIPT
 	$(srcdir)/Makefile.in
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/libextra/m4/hooks.m4 \
-		      $(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \
-		      $(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \
-		      $(top_srcdir)/gl/m4/arpa_inet_h.m4 \
-		      $(top_srcdir)/gl/m4/asm-underscore.m4 \
-		      $(top_srcdir)/gl/m4/autobuild.m4 \
-		      $(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \
-		      $(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \
-		      $(top_srcdir)/gl/m4/extensions.m4 \
-		      $(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \
-		      $(top_srcdir)/gl/m4/fseeko.m4 \
-		      $(top_srcdir)/gl/m4/getaddrinfo.m4 \
-		      $(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \
-		      $(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \
-		      $(top_srcdir)/gl/m4/gettimeofday.m4 \
-		      $(top_srcdir)/gl/m4/gnulib-common.m4 \
-		      $(top_srcdir)/gl/m4/gnulib-comp.m4 \
-		      $(top_srcdir)/gl/m4/hostent.m4 \
-		      $(top_srcdir)/gl/m4/include_next.m4 \
-		      $(top_srcdir)/gl/m4/inet_ntop.m4 \
-		      $(top_srcdir)/gl/m4/inet_pton.m4 \
-		      $(top_srcdir)/gl/m4/intmax_t.m4 \
-		      $(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \
-		      $(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \
-		      $(top_srcdir)/gl/m4/lib-prefix.m4 \
-		      $(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \
-		      $(top_srcdir)/gl/m4/malloc.m4 \
-		      $(top_srcdir)/gl/m4/manywarnings.m4 \
-		      $(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \
-		      $(top_srcdir)/gl/m4/mmap-anon.m4 \
-		      $(top_srcdir)/gl/m4/multiarch.m4 \
-		      $(top_srcdir)/gl/m4/netdb_h.m4 \
-		      $(top_srcdir)/gl/m4/netinet_in_h.m4 \
-		      $(top_srcdir)/gl/m4/onceonly_2_57.m4 \
-		      $(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \
-		      $(top_srcdir)/gl/m4/read-file.m4 \
-		      $(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \
-		      $(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \
-		      $(top_srcdir)/gl/m4/size_max.m4 \
-		      $(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \
-		      $(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \
-		      $(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \
-		      $(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \
-		      $(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \
-		      $(top_srcdir)/gl/m4/stdlib_h.m4 \
-		      $(top_srcdir)/gl/m4/strerror.m4 \
-		      $(top_srcdir)/gl/m4/string_h.m4 \
-		      $(top_srcdir)/gl/m4/sys_ioctl_h.m4 \
-		      $(top_srcdir)/gl/m4/sys_select_h.m4 \
-		      $(top_srcdir)/gl/m4/sys_socket_h.m4 \
-		      $(top_srcdir)/gl/m4/sys_stat_h.m4 \
-		      $(top_srcdir)/gl/m4/sys_time_h.m4 \
-		      $(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \
-		      $(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \
-		      $(top_srcdir)/gl/m4/valgrind-tests.m4 \
-		      $(top_srcdir)/gl/m4/vasnprintf.m4 \
-		      $(top_srcdir)/gl/m4/version-etc.m4 \
-		      $(top_srcdir)/gl/m4/warn-on-use.m4 \
-		      $(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \
-		      $(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \
-		      $(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \
-		      $(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \
-		      $(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
-		      $(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
-		      $(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac
+	$(top_srcdir)/lib/m4/hooks.m4 $(top_srcdir)/lib/gl/m4/po.m4 \
+	$(top_srcdir)/gl/m4/00gnulib.m4 $(top_srcdir)/gl/m4/alloca.m4 \
+	$(top_srcdir)/gl/m4/arpa_inet_h.m4 \
+	$(top_srcdir)/gl/m4/asm-underscore.m4 \
+	$(top_srcdir)/gl/m4/autobuild.m4 \
+	$(top_srcdir)/gl/m4/clock_time.m4 $(top_srcdir)/gl/m4/close.m4 \
+	$(top_srcdir)/gl/m4/errno_h.m4 $(top_srcdir)/gl/m4/error.m4 \
+	$(top_srcdir)/gl/m4/extensions.m4 \
+	$(top_srcdir)/gl/m4/fclose.m4 $(top_srcdir)/gl/m4/float_h.m4 \
+	$(top_srcdir)/gl/m4/fseeko.m4 \
+	$(top_srcdir)/gl/m4/getaddrinfo.m4 \
+	$(top_srcdir)/gl/m4/getdelim.m4 $(top_srcdir)/gl/m4/getline.m4 \
+	$(top_srcdir)/gl/m4/getpass.m4 $(top_srcdir)/gl/m4/gettime.m4 \
+	$(top_srcdir)/gl/m4/gettimeofday.m4 \
+	$(top_srcdir)/gl/m4/gnulib-common.m4 \
+	$(top_srcdir)/gl/m4/gnulib-comp.m4 \
+	$(top_srcdir)/gl/m4/hostent.m4 \
+	$(top_srcdir)/gl/m4/include_next.m4 \
+	$(top_srcdir)/gl/m4/inet_ntop.m4 \
+	$(top_srcdir)/gl/m4/inet_pton.m4 \
+	$(top_srcdir)/gl/m4/intmax_t.m4 \
+	$(top_srcdir)/gl/m4/inttypes_h.m4 $(top_srcdir)/gl/m4/ioctl.m4 \
+	$(top_srcdir)/gl/m4/lib-ld.m4 $(top_srcdir)/gl/m4/lib-link.m4 \
+	$(top_srcdir)/gl/m4/lib-prefix.m4 \
+	$(top_srcdir)/gl/m4/longlong.m4 $(top_srcdir)/gl/m4/lseek.m4 \
+	$(top_srcdir)/gl/m4/malloc.m4 \
+	$(top_srcdir)/gl/m4/manywarnings.m4 \
+	$(top_srcdir)/gl/m4/memchr.m4 $(top_srcdir)/gl/m4/minmax.m4 \
+	$(top_srcdir)/gl/m4/mmap-anon.m4 \
+	$(top_srcdir)/gl/m4/multiarch.m4 \
+	$(top_srcdir)/gl/m4/netdb_h.m4 \
+	$(top_srcdir)/gl/m4/netinet_in_h.m4 \
+	$(top_srcdir)/gl/m4/onceonly_2_57.m4 \
+	$(top_srcdir)/gl/m4/perror.m4 $(top_srcdir)/gl/m4/printf.m4 \
+	$(top_srcdir)/gl/m4/read-file.m4 \
+	$(top_srcdir)/gl/m4/readline.m4 $(top_srcdir)/gl/m4/realloc.m4 \
+	$(top_srcdir)/gl/m4/select.m4 $(top_srcdir)/gl/m4/servent.m4 \
+	$(top_srcdir)/gl/m4/size_max.m4 \
+	$(top_srcdir)/gl/m4/snprintf.m4 $(top_srcdir)/gl/m4/sockets.m4 \
+	$(top_srcdir)/gl/m4/socklen.m4 $(top_srcdir)/gl/m4/sockpfaf.m4 \
+	$(top_srcdir)/gl/m4/stdarg.m4 $(top_srcdir)/gl/m4/stdbool.m4 \
+	$(top_srcdir)/gl/m4/stddef_h.m4 $(top_srcdir)/gl/m4/stdint.m4 \
+	$(top_srcdir)/gl/m4/stdint_h.m4 $(top_srcdir)/gl/m4/stdio_h.m4 \
+	$(top_srcdir)/gl/m4/stdlib_h.m4 \
+	$(top_srcdir)/gl/m4/strerror.m4 \
+	$(top_srcdir)/gl/m4/string_h.m4 \
+	$(top_srcdir)/gl/m4/sys_ioctl_h.m4 \
+	$(top_srcdir)/gl/m4/sys_select_h.m4 \
+	$(top_srcdir)/gl/m4/sys_socket_h.m4 \
+	$(top_srcdir)/gl/m4/sys_stat_h.m4 \
+	$(top_srcdir)/gl/m4/sys_time_h.m4 \
+	$(top_srcdir)/gl/m4/time_h.m4 $(top_srcdir)/gl/m4/timespec.m4 \
+	$(top_srcdir)/gl/m4/ungetc.m4 $(top_srcdir)/gl/m4/unistd_h.m4 \
+	$(top_srcdir)/gl/m4/valgrind-tests.m4 \
+	$(top_srcdir)/gl/m4/vasnprintf.m4 \
+	$(top_srcdir)/gl/m4/version-etc.m4 \
+	$(top_srcdir)/gl/m4/warn-on-use.m4 \
+	$(top_srcdir)/gl/m4/warnings.m4 $(top_srcdir)/gl/m4/wchar_h.m4 \
+	$(top_srcdir)/gl/m4/wchar_t.m4 $(top_srcdir)/gl/m4/wint_t.m4 \
+	$(top_srcdir)/gl/m4/xsize.m4 $(top_srcdir)/m4/gtk-doc.m4 \
+	$(top_srcdir)/m4/guile.m4 $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/m4/pkg.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-		     	$(ACLOCAL_M4)
+	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__EXEEXT_1 = srn0$(EXEEXT) srn1$(EXEEXT) srn2$(EXEEXT) srn3$(EXEEXT) \
-	       	srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT)
+	srn4$(EXEEXT) srn5$(EXEEXT) srn6$(EXEEXT) srn7$(EXEEXT)
 srn0_SOURCES = srn0.c
 srn0_OBJECTS = srn0.$(OBJEXT)
 srn0_LDADD = $(LDADD)
 am__DEPENDENCIES_1 =
 srn0_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn1_SOURCES = srn1.c
 srn1_OBJECTS = srn1.$(OBJEXT)
 srn1_LDADD = $(LDADD)
 srn1_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn2_SOURCES = srn2.c
 srn2_OBJECTS = srn2.$(OBJEXT)
 srn2_LDADD = $(LDADD)
 srn2_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn3_SOURCES = srn3.c
 srn3_OBJECTS = srn3.$(OBJEXT)
 srn3_LDADD = $(LDADD)
 srn3_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn4_SOURCES = srn4.c
 srn4_OBJECTS = srn4.$(OBJEXT)
 srn4_LDADD = $(LDADD)
 srn4_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn5_SOURCES = srn5.c
 srn5_OBJECTS = srn5.$(OBJEXT)
 srn5_LDADD = $(LDADD)
 srn5_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn6_SOURCES = srn6.c
 srn6_OBJECTS = srn6.$(OBJEXT)
 srn6_LDADD = $(LDADD)
 srn6_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 srn7_SOURCES = srn7.c
 srn7_OBJECTS = srn7.$(OBJEXT)
 srn7_LDADD = $(LDADD)
 srn7_DEPENDENCIES = ../../lib/libgnutls.la $(am__DEPENDENCIES_1) \
-		    	$(am__DEPENDENCIES_1)
+	$(am__DEPENDENCIES_1)
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp
 am__depfiles_maybe = depfiles
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
-	  	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	    	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
-			$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
+	$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 CCLD = $(CC)
 LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-       	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
-		$(LDFLAGS) -o $@
+	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
+	$(LDFLAGS) -o $@
 SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c
 DIST_SOURCES = srn0.c srn1.c srn2.c srn3.c srn4.c srn5.c srn6.c srn7.c
 ETAGS = etags
 CTAGS = ctags
 am__tty_colors = \
-		 red=; grn=; lgn=; blu=; std=
+red=; grn=; lgn=; blu=; std=
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 ALLOCA = @ALLOCA@
@@ -887,7 +887,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/includes -
 
 AM_LDFLAGS = -no-install
 #LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET)
-LDADD = -L$(top_builddir)/libextra -lgnutls-extra       \
+LDADD = ../../lib/libgnutls.la $(LTLIBGCRYPT) $(LIBSOCKET) \
+	-L$(top_builddir)/libextra -lgnutls-extra       \
 	-L$(top_builddir)/lib      -lgnutls             \
 	-L$(top_builddir)/tests    -lutils
 ctests = srn0 srn1 srn2 srn3 srn4 srn5 srn6 srn7
@@ -897,7 +898,7 @@ dist_check_SCRIPTS = testsrn
 all: all-am
 
 .SUFFIXES:
-	.SUFFIXES: .c .lo .o .obj
+.SUFFIXES: .c .lo .o .obj
 	$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 		case '$(am__configure_deps)' in \
@@ -910,8 +911,8 @@ all: all-am
 		echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile'; \
 		$(am__cd) $(top_srcdir) && \
 		$(AUTOMAKE) --gnu tests/safe-renegotiation/Makefile
-	.PRECIOUS: Makefile
-	Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 		*config.status*) \
 		cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
@@ -930,43 +931,43 @@ $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 $(am__aclocal_m4_deps):
 
 clean-checkPROGRAMS:
-		@list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \
-				echo " rm -f" $$list; \
-					rm -f $$list || exit $$?; \
-						test -n "$(EXEEXT)" || exit 0; \
-							list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
-								echo " rm -f" $$list; \
-									rm -f $$list
-		srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) 
-			@rm -f srn0$(EXEEXT)
-				$(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS)
+	@list='$(check_PROGRAMS)'; test -n "$$list" || exit 0; \
+	echo " rm -f" $$list; \
+	rm -f $$list || exit $$?; \
+	test -n "$(EXEEXT)" || exit 0; \
+	list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
+	echo " rm -f" $$list; \
+	rm -f $$list
+srn0$(EXEEXT): $(srn0_OBJECTS) $(srn0_DEPENDENCIES) 
+	@rm -f srn0$(EXEEXT)
+	$(LINK) $(srn0_OBJECTS) $(srn0_LDADD) $(LIBS)
 srn1$(EXEEXT): $(srn1_OBJECTS) $(srn1_DEPENDENCIES) 
-		@rm -f srn1$(EXEEXT)
-			$(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS)
+	@rm -f srn1$(EXEEXT)
+	$(LINK) $(srn1_OBJECTS) $(srn1_LDADD) $(LIBS)
 srn2$(EXEEXT): $(srn2_OBJECTS) $(srn2_DEPENDENCIES) 
-		@rm -f srn2$(EXEEXT)
-			$(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS)
+	@rm -f srn2$(EXEEXT)
+	$(LINK) $(srn2_OBJECTS) $(srn2_LDADD) $(LIBS)
 srn3$(EXEEXT): $(srn3_OBJECTS) $(srn3_DEPENDENCIES) 
-		@rm -f srn3$(EXEEXT)
-			$(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS)
+	@rm -f srn3$(EXEEXT)
+	$(LINK) $(srn3_OBJECTS) $(srn3_LDADD) $(LIBS)
 srn4$(EXEEXT): $(srn4_OBJECTS) $(srn4_DEPENDENCIES) 
-		@rm -f srn4$(EXEEXT)
-			$(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS)
+	@rm -f srn4$(EXEEXT)
+	$(LINK) $(srn4_OBJECTS) $(srn4_LDADD) $(LIBS)
 srn5$(EXEEXT): $(srn5_OBJECTS) $(srn5_DEPENDENCIES) 
-		@rm -f srn5$(EXEEXT)
-			$(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS)
+	@rm -f srn5$(EXEEXT)
+	$(LINK) $(srn5_OBJECTS) $(srn5_LDADD) $(LIBS)
 srn6$(EXEEXT): $(srn6_OBJECTS) $(srn6_DEPENDENCIES) 
-		@rm -f srn6$(EXEEXT)
-			$(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS)
+	@rm -f srn6$(EXEEXT)
+	$(LINK) $(srn6_OBJECTS) $(srn6_LDADD) $(LIBS)
 srn7$(EXEEXT): $(srn7_OBJECTS) $(srn7_DEPENDENCIES) 
-		@rm -f srn7$(EXEEXT)
-			$(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS)
+	@rm -f srn7$(EXEEXT)
+	$(LINK) $(srn7_OBJECTS) $(srn7_LDADD) $(LIBS)
 
 mostlyclean-compile:
-		-rm -f *.$(OBJEXT)
+	-rm -f *.$(OBJEXT)
 
 distclean-compile:
-		-rm -f *.tab.c
+	-rm -f *.tab.c
 
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn0.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn1.Po@am__quote@
@@ -978,25 +979,25 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/srn7.Po@am__quote@
 
 .c.o:
-	@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-	@am__fastdepCC_FALSE@	$(COMPILE) -c $<
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(COMPILE) -c $<
 
 .c.obj:
-	@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-	@am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
-	@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-	@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
-	@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-	@am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
+@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
 
 mostlyclean-libtool:
 	-rm -f *.lo
@@ -1178,28 +1179,28 @@ distdir: $(DISTFILES)
 		|| exit 1; \
 		fi; \
 		done
-	check-am: all-am
+check-am: all-am
 	$(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) \
-		$(dist_check_SCRIPTS)
+	  $(dist_check_SCRIPTS)
 	$(MAKE) $(AM_MAKEFLAGS) check-TESTS
-	check: check-am
-	all-am: Makefile
+check: check-am
+all-am: Makefile
 installdirs:
-	install: install-am
-	install-exec: install-exec-am
-	install-data: install-data-am
-	uninstall: uninstall-am
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
 
 install-am: all-am
 	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
 
 installcheck: installcheck-am
-	install-strip:
+install-strip:
 	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
 		install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
 		`test -z '$(STRIP)' || \
 		echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
-	mostlyclean-generic:
+mostlyclean-generic:
 
 clean-generic:
 
@@ -1210,7 +1211,7 @@ distclean-generic:
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
-	clean: clean-am
+clean: clean-am
 
 clean-am: clean-checkPROGRAMS clean-generic clean-libtool \
 	mostlyclean-am
@@ -1218,7 +1219,7 @@ clean-am: clean-checkPROGRAMS clean-gene
 distclean: distclean-am
 	-rm -rf ./$(DEPDIR)
 	-rm -f Makefile
-	distclean-am: clean-am distclean-compile distclean-generic \
+distclean-am: clean-am distclean-compile distclean-generic \
 		distclean-tags
 
 dvi: dvi-am
@@ -1264,7 +1265,7 @@ installcheck-am:
 maintainer-clean: maintainer-clean-am
 	-rm -rf ./$(DEPDIR)
 	-rm -f Makefile
-	maintainer-clean-am: distclean-am maintainer-clean-generic
+maintainer-clean-am: distclean-am maintainer-clean-generic
 
 mostlyclean: mostlyclean-am
 
Index: gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/Makefile.in
+++ gnutls-2.4.1/tests/safe-renegotiation/Makefile.in
@@ -1059,95 +1059,96 @@ distclean-tags:
 
 check-TESTS: $(TESTS)
 	@failed=0; all=0; xfail=0; xpass=0; skip=0; \
-		srcdir=$(srcdir); export srcdir; \
-		list=' $(TESTS) '; \
-		$(am__tty_colors); \
-		if test -n "$$list"; then \
+	srcdir=$(srcdir); export srcdir; \
+	list=' $(TESTS) '; \
+	$(am__tty_colors); \
+	if test -n "$$list"; then \
 		for tst in $$list; do \
-		if test -f ./$$tst; then dir=./; \
-		elif test -f $$tst; then dir=; \
-		else dir="$(srcdir)/"; fi; \
-		if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
-		all=`expr $$all + 1`; \
-		case " $(XFAIL_TESTS) " in \
-		*[\ \	]$$tst[\ \	]*) \
-		xpass=`expr $$xpass + 1`; \
-		failed=`expr $$failed + 1`; \
-		col=$$red; res=XPASS; \
-		;; \
-		*) \
-		col=$$grn; res=PASS; \
-		;; \
-		esac; \
-		elif test $$? -ne 77; then \
-		all=`expr $$all + 1`; \
-		case " $(XFAIL_TESTS) " in \
-		*[\ \	]$$tst[\ \	]*) \
-		xfail=`expr $$xfail + 1`; \
-		col=$$lgn; res=XFAIL; \
-		;; \
-		*) \
-		failed=`expr $$failed + 1`; \
-		col=$$red; res=FAIL; \
-		;; \
-		esac; \
-		else \
-		skip=`expr $$skip + 1`; \
-		col=$$blu; res=SKIP; \
-		fi; \
-		echo "$${col}$$res$${std}: $$tst"; \
+			echo "test---------$$tst"
+			if test -f ./$$tst; then dir=./; \
+			elif test -f $$tst; then dir=; \
+			else dir="$(srcdir)/"; fi; \
+			if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
+			all=`expr $$all + 1`; \
+			case " $(XFAIL_TESTS) " in \
+			*[\ \	]$$tst[\ \	]*) \
+			xpass=`expr $$xpass + 1`; \
+			failed=`expr $$failed + 1`; \
+			col=$$red; res=XPASS; \
+			;; \
+			*) \
+			col=$$grn; res=PASS; \
+			;; \
+			esac; \
+			elif test $$? -ne 77; then \
+			all=`expr $$all + 1`; \
+			case " $(XFAIL_TESTS) " in \
+			*[\ \	]$$tst[\ \	]*) \
+			xfail=`expr $$xfail + 1`; \
+			col=$$lgn; res=XFAIL; \
+			;; \
+			*) \
+			failed=`expr $$failed + 1`; \
+			col=$$red; res=FAIL; \
+			;; \
+			esac; \
+			else \
+			skip=`expr $$skip + 1`; \
+			col=$$blu; res=SKIP; \
+			fi; \
+			echo "$${col}$$res$${std}: $$tst"; \
 		done; \
 		if test "$$all" -eq 1; then \
-		tests="test"; \
-		All=""; \
-		else \
-		tests="tests"; \
-		All="All "; \
-		fi; \
-		if test "$$failed" -eq 0; then \
-		if test "$$xfail" -eq 0; then \
-		banner="$$All$$all $$tests passed"; \
-		else \
-		if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \
-		banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \
-		fi; \
-		else \
-		if test "$$xpass" -eq 0; then \
-		banner="$$failed of $$all $$tests failed"; \
-		else \
-		if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \
-		banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \
-		fi; \
-		fi; \
-		dashes="$$banner"; \
-		skipped=""; \
-		if test "$$skip" -ne 0; then \
-		if test "$$skip" -eq 1; then \
-		skipped="($$skip test was not run)"; \
-		else \
-		skipped="($$skip tests were not run)"; \
-		fi; \
-		test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
-		dashes="$$skipped"; \
-		fi; \
-		report=""; \
-		if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \
-		report="Please report to $(PACKAGE_BUGREPORT)"; \
-		test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \
-		dashes="$$report"; \
-		fi; \
-		dashes=`echo "$$dashes" | sed s/./=/g`; \
-		if test "$$failed" -eq 0; then \
-		echo "$$grn$$dashes"; \
-		else \
-		echo "$$red$$dashes"; \
-		fi; \
-		echo "$$banner"; \
-		test -z "$$skipped" || echo "$$skipped"; \
-		test -z "$$report" || echo "$$report"; \
-		echo "$$dashes$$std"; \
-		test "$$failed" -eq 0; \
-		else :; fi
+			tests="test"; \
+			All=""; \
+			else \
+			tests="tests"; \
+			All="All "; \
+			fi; \
+			if test "$$failed" -eq 0; then \
+			if test "$$xfail" -eq 0; then \
+			banner="$$All$$all $$tests passed"; \
+			else \
+			if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \
+			banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \
+			fi; \
+			else \
+			if test "$$xpass" -eq 0; then \
+			banner="$$failed of $$all $$tests failed"; \
+			else \
+			if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \
+			banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \
+			fi; \
+			fi; \
+			dashes="$$banner"; \
+			skipped=""; \
+			if test "$$skip" -ne 0; then \
+			if test "$$skip" -eq 1; then \
+			skipped="($$skip test was not run)"; \
+			else \
+			skipped="($$skip tests were not run)"; \
+			fi; \
+			test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
+			dashes="$$skipped"; \
+			fi; \
+			report=""; \
+			if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \
+			report="Please report to $(PACKAGE_BUGREPORT)"; \
+			test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \
+			dashes="$$report"; \
+			fi; \
+			dashes=`echo "$$dashes" | sed s/./=/g`; \
+			if test "$$failed" -eq 0; then \
+			echo "$$grn$$dashes"; \
+			else \
+			echo "$$red$$dashes"; \
+			fi; \
+			echo "$$banner"; \
+			test -z "$$skipped" || echo "$$skipped"; \
+			test -z "$$report" || echo "$$report"; \
+			echo "$$dashes$$std"; \
+			test "$$failed" -eq 0; \
+	else :; fi
 
 distdir: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c
+++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c
@@ -74,7 +74,10 @@ client_push (gnutls_transport_ptr_t tr,
 
 	tmp = realloc (to_server, newlen);
 	if (!tmp)
+	{
+		puts ("1Client or server using extension before handshake?");
 		abort ();
+	}
 	to_server = tmp;
 
 	memcpy (to_server + to_server_len, data, len);
@@ -108,7 +111,10 @@ server_push (gnutls_transport_ptr_t tr,
 
 	tmp = realloc (to_client, newlen);
 	if (!tmp)
+	{
+		puts ("2Client or server using extension before handshake?");
 		abort ();
+	}
 	to_client = tmp;
 
 	memcpy (to_client + to_client_len, data, len);
@@ -197,6 +203,7 @@ main (int argc, char *argv[])
 	gnutls_transport_set_push_function (client, client_push);
 	gnutls_transport_set_pull_function (client, client_pull);
 
+	puts ("3Client or server using extension before handshake?");
 	/* Check that initially no session use the extension. */
 	if (gnutls_safe_renegotiation_status (server)
 			|| gnutls_safe_renegotiation_status (client))
@@ -204,12 +211,16 @@ main (int argc, char *argv[])
 		puts ("Client or server using extension before handshake?");
 		abort ();
 	}
+	puts ("4Client or server using extension before handshake?");
 
 	do
 	{
 		static int max_iter = 0;
 		if (max_iter++ > 10)
+		{
+			puts ("5Client or server using extension before handshake?");
 			abort ();
+		}
 
 		if (cret == GNUTLS_E_AGAIN)
 		{
@@ -262,7 +273,10 @@ main (int argc, char *argv[])
 		char b[1];
 		n = gnutls_record_recv (client, b, 1);
 		if (n != GNUTLS_E_REHANDSHAKE)
+		{
+			puts ("6Client or server using extension before handshake?");
 			abort ();
+		}
 	}
 
 	cret = GNUTLS_E_AGAIN;
@@ -272,7 +286,10 @@ main (int argc, char *argv[])
 	{
 		static int max_iter = 0;
 		if (max_iter++ > 10)
+		{
+			puts ("7Client or server using extension before handshake?");
 			abort ();
+		}
 
 		if (cret == GNUTLS_E_AGAIN)
 		{
Index: gnutls-2.4.1/src/tests.c
===================================================================
--- gnutls-2.4.1.orig/src/tests.c
+++ gnutls-2.4.1/src/tests.c
@@ -106,11 +106,6 @@ do_handshake (gnutls_session_t session)
 
 char protocol_str[] = "+VERS-TLS1.0:+VERS-SSL3.0";
 char prio_str[256] = "";
-static const int kx_priority[16] =
-  { GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA,
-  GNUTLS_KX_ANON_DH,
-  GNUTLS_KX_RSA_EXPORT, 0
-};
 #define ALL_CIPHERS "+3DES-CBC:+ARCFOUR-128:+ARCFOUR-40"
 #define ALL_COMP "+COMP-NULL"
 #define ALL_MACS "+SHA1:+MD5"
Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c
+++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c
@@ -225,6 +225,7 @@ main (int argc, char *argv[])
 		if (cret == GNUTLS_E_AGAIN)
 		{
 			cret = gnutls_handshake (client);
+			printf ("cret: %d", cret);
 			if (debug_level > 0)
 			{
 				tls_log_func (0, "gnutls_handshake (client)...\n");
@@ -236,6 +237,7 @@ main (int argc, char *argv[])
 		if (sret == GNUTLS_E_AGAIN)
 		{
 			sret = gnutls_handshake (server);
+			printf ("sret: %d", sret);
 			if (debug_level > 0)
 			{
 				tls_log_func (0, "gnutls_handshake (server)...\n");
Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c
+++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c
@@ -222,10 +222,10 @@ main (int argc, char *argv[])
 			abort ();
 		}
 
+		printf ("cret: %d | sret: %d \n", cret, sret);
 		if (cret == GNUTLS_E_AGAIN)
 		{
 			cret = gnutls_handshake (client);
-			printf ("cret: %d", cret);
 			if (debug_level > 0)
 			{
 				tls_log_func (0, "gnutls_handshake (client)...\n");
@@ -237,7 +237,6 @@ main (int argc, char *argv[])
 		if (sret == GNUTLS_E_AGAIN)
 		{
 			sret = gnutls_handshake (server);
-			printf ("sret: %d", sret);
 			if (debug_level > 0)
 			{
 				tls_log_func (0, "gnutls_handshake (server)...\n");
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -2469,22 +2469,27 @@ gnutls_handshake (gnutls_session_t sessi
 {
   int ret;
 
+  puts("handshake--1");
   if ((ret = _gnutls_handshake_hash_init (session)) < 0)
     {
       gnutls_assert ();
       return ret;
     }
+  puts("handshake--2");
 
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
+  	puts("handshake--3");
       ret = _gnutls_handshake_client (session);
     }
   else
     {
+  	puts("handshake--4");
       ret = _gnutls_handshake_server (session);
     }
   if (ret < 0)
     {
+  	puts("handshake--5");
       /* In the case of a rehandshake abort
        * we should reset the handshake's internal state.
        */
@@ -2494,16 +2499,19 @@ gnutls_handshake (gnutls_session_t sessi
       return ret;
     }
 
+  	puts("handshake--6");
   ret = _gnutls_handshake_common (session);
 
   if (ret < 0)
     {
+  	puts("handshake--7");
       if (_gnutls_abort_handshake (session, ret) == 0)
 	STATE = STATE0;
 
       return ret;
     }
 
+  	puts("handshake--8");
   STATE = STATE0;
 
   _gnutls_handshake_io_buffer_clear (session);
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -54,6 +54,9 @@
 #include <auth_psk.h>		/* for gnutls_psk_server_credentials_t */
 #include <gc.h>
 #include <random.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 
 #ifdef HANDSHAKE_DEBUG
 #define ERR(x, y) _gnutls_handshake_log( "HSK[%x]: %s (%d)\n", session, x,y)
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1860,12 +1860,14 @@ _gnutls_send_client_hello (gnutls_sessio
 	  hver = session->internals.resumed_security_parameters.version;
 	}
 
+      puts("1111111111111111111111111");
       if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0)
 	{
 	  gnutls_assert ();
 	  gnutls_free (data);
 	  return GNUTLS_E_INTERNAL_ERROR;
 	}
+      puts("2222222222222222222222222");
 
       data[pos++] = _gnutls_version_get_major (hver);
       data[pos++] = _gnutls_version_get_minor (hver);
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1825,12 +1825,16 @@ _gnutls_send_client_hello (gnutls_sessio
   opaque rnd[TLS_RANDOM_SIZE];
   gnutls_protocol_t hver;
   opaque extdata[MAX_EXT_DATA_LENGTH];
+  int rehandshake = 0;
 
   opaque *SessionID =
     session->internals.resumed_security_parameters.session_id;
   uint8_t session_id_len =
     session->internals.resumed_security_parameters.session_id_size;
 
+  if (session->security_parameters.session_id_size)
+	      rehandshake = 1;
+
   if (SessionID == NULL)
     session_id_len = 0;
   else if (session_id_len == 0)
@@ -1854,7 +1858,13 @@ _gnutls_send_client_hello (gnutls_sessio
        * version number to the previously established.
        */
       if (SessionID == NULL)
-	hver = _gnutls_version_max (session);
+      {
+	      if (rehandshake) /* already negotiated version thus version_max == negotiated version */
+		      hver = session->security_parameters.version;
+	      else
+
+		      hver = _gnutls_version_max (session);
+      }
       else
 	{			/* we are resuming a session */
 	  hver = session->internals.resumed_security_parameters.version;
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1871,6 +1871,7 @@ _gnutls_send_client_hello (gnutls_sessio
 	}
 
       puts("1111111111111111111111111");
+      printf("version info: %d | GNUTLS_SSL3 :1 |GNUTLS_TLS1_0|GNUTLS_TLS1_1|GNUTLS_TLS1_2|GNUTLS_VERSION_UNKNOWN : 0xff| \n",(int)hver);
       if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0)
 	{
 	  gnutls_assert ();
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1860,10 +1860,15 @@ _gnutls_send_client_hello (gnutls_sessio
       if (SessionID == NULL)
       {
 	      if (rehandshake) /* already negotiated version thus version_max == negotiated version */
+	      {
 		      hver = session->security_parameters.version;
+		      printf("session->security_parameters.version: %d\n",session->security_parameters.version);
+	      }
 	      else
-
+	      {
 		      hver = _gnutls_version_max (session);
+		      printf("_gnutls_version_max: %d\n", hver);
+	      }
       }
       else
 	{			/* we are resuming a session */
Index: gnutls-2.4.1/lib/gnutls_priority.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_priority.c
+++ gnutls-2.4.1/lib/gnutls_priority.c
@@ -654,12 +654,42 @@ gnutls_priority_init (gnutls_priority_t
 	    goto error;
 	}
       else if (broken_list[i][0] == '%')
-	{
-	  if (strcasecmp (&broken_list[i][1], "COMPAT") == 0)
-	    (*priority_cache)->no_padding = 1;
-	  else
-	    goto error;
-	}
+      {
+	      if (strcasecmp (&broken_list[i][1], "COMPAT") == 0)
+		      (*priority_cache)->no_padding = 1;
+	      else if (strcasecmp (&broken_list[i][1],
+				      "VERIFY_ALLOW_SIGN_RSA_MD5") == 0)
+		      (*priority_cache)->additional_verify_flags |=
+			      GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5;
+	      else if (strcasecmp (&broken_list[i][1],
+				      "SSL3_RECORD_VERSION") == 0)
+		      (*priority_cache)->ssl3_record_version = 1;
+	      else if (strcasecmp (&broken_list[i][1],
+				      "VERIFY_ALLOW_X509_V1_CA_CRT") == 0)
+		      (*priority_cache)->additional_verify_flags |=
+			      GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT;
+	      else if (strcasecmp (&broken_list[i][1],
+				      "UNSAFE_RENEGOTIATION") == 0)
+	      {
+		      (*priority_cache)->sr = SR_UNSAFE;
+	      }
+	      else if (strcasecmp (&broken_list[i][1], "SAFE_RENEGOTIATION") == 0)
+	      {
+		      (*priority_cache)->sr = SR_SAFE;
+	      }
+	      else if (strcasecmp (&broken_list[i][1],
+				      "PARTIAL_RENEGOTIATION") == 0)
+	      {
+		      (*priority_cache)->sr = SR_PARTIAL;
+	      }
+	      else if (strcasecmp (&broken_list[i][1],
+				      "DISABLE_SAFE_RENEGOTIATION") == 0)
+	      {
+		      (*priority_cache)->sr = SR_DISABLED;
+	      }
+	      else
+		      goto error;
+      }
       else
 	goto error;
     }
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1893,15 +1893,24 @@ _gnutls_send_client_hello (gnutls_sessio
        */
       _gnutls_set_adv_version (session, hver);
 
-      /* Some old implementations do not interoperate if we send a
-       * different version in the record layer.
-       * It seems they prefer to read the record's version
-       * as the one we actually requested.
-       * The proper behaviour is to use the one in the client hello 
-       * handshake packet and ignore the one in the packet's record 
-       * header.
-       */
-      _gnutls_set_current_version (session, hver);
+      if (session->internals.priorities.ssl3_record_version)
+      {
+	      /* Honor the SSL3_RECORD_VERSION option
+	       *            */
+	      _gnutls_set_current_version (session, GNUTLS_SSL3);
+      }
+      else
+      {
+	      /* Some old implementations do not interoperate if we send a
+	       * different version in the record layer.
+	       * It seems they prefer to read the record's version
+	       * as the one we actually requested.
+	       * The proper behaviour is to use the one in the client hello 
+	       * handshake packet and ignore the one in the packet's record 
+	       * header.
+	       */
+	      _gnutls_set_current_version (session, hver);
+      }
 
       /* In order to know when this session was initiated.
        */
Index: gnutls-2.4.1/lib/gnutls_int.h
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_int.h
+++ gnutls-2.4.1/lib/gnutls_int.h
@@ -428,6 +428,8 @@ struct gnutls_priority_st
   /* to disable record padding */
   int no_padding:1;
   safe_renegotiation_t sr;
+  int ssl3_record_version;
+  int additional_verify_flags;
 };
 
 
Index: gnutls-2.4.1/lib/gnutls_x509.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_x509.c
+++ gnutls-2.4.1/lib/gnutls_x509.c
@@ -178,7 +178,7 @@ _gnutls_x509_cert_verify_peers (gnutls_s
 				 peer_certificate_list_size,
 				 cred->x509_ca_list, cred->x509_ncas,
 				 cred->x509_crl_list, cred->x509_ncrls,
-				 cred->verify_flags, status);
+				 cred->verify_flags| session->internals.priorities.additional_verify_flags, status);
 
   CLEAR_CERTS;
 
cta: command not found
cta: command not found
Index: gnutls-2.4.1/lib/gnutls_handshake.c
===================================================================
--- gnutls-2.4.1.orig/lib/gnutls_handshake.c
+++ gnutls-2.4.1/lib/gnutls_handshake.c
@@ -1862,12 +1862,10 @@ _gnutls_send_client_hello (gnutls_sessio
 	      if (rehandshake) /* already negotiated version thus version_max == negotiated version */
 	      {
 		      hver = session->security_parameters.version;
-		      printf("session->security_parameters.version: %d\n",session->security_parameters.version);
 	      }
 	      else
 	      {
 		      hver = _gnutls_version_max (session);
-		      printf("_gnutls_version_max: %d\n", hver);
 	      }
       }
       else
@@ -1875,15 +1873,12 @@ _gnutls_send_client_hello (gnutls_sessio
 	  hver = session->internals.resumed_security_parameters.version;
 	}
 
-      puts("1111111111111111111111111");
-      printf("version info: %d | GNUTLS_SSL3 :1 |GNUTLS_TLS1_0|GNUTLS_TLS1_1|GNUTLS_TLS1_2|GNUTLS_VERSION_UNKNOWN : 0xff| \n",(int)hver);
       if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0)
 	{
 	  gnutls_assert ();
 	  gnutls_free (data);
 	  return GNUTLS_E_INTERNAL_ERROR;
 	}
-      puts("2222222222222222222222222");
 
       data[pos++] = _gnutls_version_get_major (hver);
       data[pos++] = _gnutls_version_get_minor (hver);
@@ -2499,27 +2494,22 @@ gnutls_handshake (gnutls_session_t sessi
 {
   int ret;
 
-  puts("handshake--1");
   if ((ret = _gnutls_handshake_hash_init (session)) < 0)
     {
       gnutls_assert ();
       return ret;
     }
-  puts("handshake--2");
 
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
-  	puts("handshake--3");
       ret = _gnutls_handshake_client (session);
     }
   else
     {
-  	puts("handshake--4");
       ret = _gnutls_handshake_server (session);
     }
   if (ret < 0)
     {
-  	puts("handshake--5");
       /* In the case of a rehandshake abort
        * we should reset the handshake's internal state.
        */
@@ -2529,19 +2519,16 @@ gnutls_handshake (gnutls_session_t sessi
       return ret;
     }
 
-  	puts("handshake--6");
   ret = _gnutls_handshake_common (session);
 
   if (ret < 0)
     {
-  	puts("handshake--7");
       if (_gnutls_abort_handshake (session, ret) == 0)
 	STATE = STATE0;
 
       return ret;
     }
 
-  	puts("handshake--8");
   STATE = STATE0;
 
   _gnutls_handshake_io_buffer_clear (session);
Index: gnutls-2.4.1/tests/safe-renegotiation/srn1.c
===================================================================
--- gnutls-2.4.1.orig/tests/safe-renegotiation/srn1.c
+++ gnutls-2.4.1/tests/safe-renegotiation/srn1.c
@@ -75,7 +75,6 @@ client_push (gnutls_transport_ptr_t tr,
 	tmp = realloc (to_server, newlen);
 	if (!tmp)
 	{
-		puts ("1Client or server using extension before handshake?");
 		abort ();
 	}
 	to_server = tmp;
@@ -112,7 +111,6 @@ server_push (gnutls_transport_ptr_t tr,
 	tmp = realloc (to_client, newlen);
 	if (!tmp)
 	{
-		puts ("2Client or server using extension before handshake?");
 		abort ();
 	}
 	to_client = tmp;
@@ -203,7 +201,6 @@ main (int argc, char *argv[])
 	gnutls_transport_set_push_function (client, client_push);
 	gnutls_transport_set_pull_function (client, client_pull);
 
-	puts ("3Client or server using extension before handshake?");
 	/* Check that initially no session use the extension. */
 	if (gnutls_safe_renegotiation_status (server)
 			|| gnutls_safe_renegotiation_status (client))
@@ -211,18 +208,15 @@ main (int argc, char *argv[])
 		puts ("Client or server using extension before handshake?");
 		abort ();
 	}
-	puts ("4Client or server using extension before handshake?");
 
 	do
 	{
 		static int max_iter = 0;
 		if (max_iter++ > 10)
 		{
-			puts ("5Client or server using extension before handshake?");
 			abort ();
 		}
 
-		printf ("cret: %d | sret: %d \n", cret, sret);
 		if (cret == GNUTLS_E_AGAIN)
 		{
 			cret = gnutls_handshake (client);
@@ -275,7 +269,6 @@ main (int argc, char *argv[])
 		n = gnutls_record_recv (client, b, 1);
 		if (n != GNUTLS_E_REHANDSHAKE)
 		{
-			puts ("6Client or server using extension before handshake?");
 			abort ();
 		}
 	}
@@ -288,7 +281,6 @@ main (int argc, char *argv[])
 		static int max_iter = 0;
 		if (max_iter++ > 10)
 		{
-			puts ("7Client or server using extension before handshake?");
 			abort ();
 		}
 
