Script to test gemini servers

Sean Conner sean at conman.org
Thu Jan 9 07:11:32 GMT 2020
It was thus said that the Great Michael Lazar once stated:
> Hi all,

  Hello.

> I have been working on a python script that can be pointed to a gemini server,
> and will automatically send various types of requests to surface errors and
> other strange server behavior. This was suggested in the mailing list a while
> ago by solderpunk(?). I thought it was a neat idea so I took my own stab at it.

  Thanks for doing this.  I find the results interesting, and yes, you did
find three bugs in GLV-1.12556.

> For example:
> 
> - Does your server support IPv6?

  Mine (GLV-1.12556) does, but my hosting provider doesn't have IPv6 yet (or
maybe they do---it's been awhile since I last checked).

> - What version of TLS do you negotiate?

  1.2---it's a limitation of the library I'm using.

> - Is your certificate's CA trusted?

  No.  I'm the one using a custom CA.

> - How do you respond to a http:// URL?

  I reject them.

> - How do you respond to a URL with an invalid UTF-8 byte sequence?

  Here's one of the bugs, and I have no idea how I'll fix this as it's a
cross-library concern.  Sigh.

> - How do you respond to a request with a newline but no carriage return?

  I respond.  I made CRs optional everywhere internally---it makes it easier
for me to test.  Now, you did make one test labeled "RequestMissingCR" where
you did send a LF.  Per the spec, I would expect this to return a 59 Bad
Request, but since I treat CRs as optional, that's why I passed that one.

> Some of the results:
> 
> - All servers use "\n" line endings on their home page instead of "\r\n"
> - No server will accept a URL without a scheme specified (per the spec, this
>   should be implied as gemini://)

  This was another bug.  I've already fixed this, and the one other bug (I
allow URLs longer than 1024 characters, which has been fixed for now).

  Again, thanks for this.

  -spc



Archive home | About this archive