1 /* 2 * Copyright (C) 2015 Red Hat, Inc. 3 * 4 * This library is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU Lesser General Public 6 * License as published by the Free Software Foundation; either 7 * version 2.1 of the License, or (at your option) any later version. 8 * 9 * This library is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 * Lesser General Public License for more details. 13 * 14 * You should have received a copy of the GNU Lesser General Public 15 * License along with this library. If not, see 16 * <http://www.gnu.org/licenses/>. 17 * 18 * Author: Daniel P. Berrange <berrange@redhat.com> 19 */ 20 21 #include "qemu/osdep.h" 22 23 #include "crypto-tls-x509-helpers.h" 24 #include "crypto/tlscredsx509.h" 25 #include "qapi/error.h" 26 #include "qemu/module.h" 27 28 #define WORKDIR "tests/test-crypto-tlscredsx509-work/" 29 #define KEYFILE WORKDIR "key-ctx.pem" 30 31 struct QCryptoTLSCredsTestData { 32 bool isServer; 33 const char *cacrt; 34 const char *crt; 35 bool expectFail; 36 }; 37 38 39 static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint, 40 const char *certdir, 41 Error **errp) 42 { 43 Object *parent = object_get_objects_root(); 44 Object *creds = object_new_with_props( 45 TYPE_QCRYPTO_TLS_CREDS_X509, 46 parent, 47 "testtlscreds", 48 errp, 49 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ? 50 "server" : "client"), 51 "dir", certdir, 52 "verify-peer", "yes", 53 "sanity-check", "yes", 54 NULL); 55 56 if (!creds) { 57 return NULL; 58 } 59 return QCRYPTO_TLS_CREDS(creds); 60 } 61 62 /* 63 * This tests sanity checking of our own certificates 64 * 65 * The code being tested is used when TLS creds are created, 66 * and aim to ensure QMEU has been configured with sane 67 * certificates. This allows us to give much much much 68 * clearer error messages to the admin when they misconfigure 69 * things. 70 */ 71 static void test_tls_creds(const void *opaque) 72 { 73 struct QCryptoTLSCredsTestData *data = 74 (struct QCryptoTLSCredsTestData *)opaque; 75 QCryptoTLSCreds *creds; 76 77 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/" 78 g_mkdir_with_parents(CERT_DIR, 0700); 79 80 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT); 81 if (data->isServer) { 82 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT); 83 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY); 84 } else { 85 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT); 86 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY); 87 } 88 89 if (access(data->cacrt, R_OK) == 0) { 90 g_assert(link(data->cacrt, 91 CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0); 92 } 93 if (data->isServer) { 94 if (access(data->crt, R_OK) == 0) { 95 g_assert(link(data->crt, 96 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0); 97 } 98 g_assert(link(KEYFILE, 99 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0); 100 } else { 101 if (access(data->crt, R_OK) == 0) { 102 g_assert(link(data->crt, 103 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0); 104 } 105 g_assert(link(KEYFILE, 106 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0); 107 } 108 109 creds = test_tls_creds_create( 110 (data->isServer ? 111 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER : 112 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT), 113 CERT_DIR, 114 data->expectFail ? NULL : &error_abort); 115 116 if (data->expectFail) { 117 g_assert(creds == NULL); 118 } else { 119 g_assert(creds != NULL); 120 } 121 122 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT); 123 if (data->isServer) { 124 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT); 125 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY); 126 } else { 127 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT); 128 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY); 129 } 130 rmdir(CERT_DIR); 131 if (creds) { 132 object_unparent(OBJECT(creds)); 133 } 134 } 135 136 int main(int argc, char **argv) 137 { 138 int ret; 139 140 module_call_init(MODULE_INIT_QOM); 141 g_test_init(&argc, &argv, NULL); 142 g_setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); 143 144 g_mkdir_with_parents(WORKDIR, 0700); 145 146 test_tls_init(KEYFILE); 147 148 # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \ 149 struct QCryptoTLSCredsTestData name = { \ 150 isServer, caCrt, crt, expectFail \ 151 }; \ 152 g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \ 153 &name, test_tls_creds); \ 154 155 /* A perfect CA, perfect client & perfect server */ 156 157 /* Basic:CA:critical */ 158 TLS_ROOT_REQ(cacertreq, 159 "UK", "qemu CA", NULL, NULL, NULL, NULL, 160 true, true, true, 161 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 162 false, false, NULL, NULL, 163 0, 0); 164 165 TLS_CERT_REQ(servercertreq, cacertreq, 166 "UK", "qemu.org", NULL, NULL, NULL, NULL, 167 true, true, false, 168 true, true, 169 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 170 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 171 0, 0); 172 TLS_CERT_REQ(clientcertreq, cacertreq, 173 "UK", "qemu", NULL, NULL, NULL, NULL, 174 true, true, false, 175 true, true, 176 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 177 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 178 0, 0); 179 180 TLS_TEST_REG(perfectserver, true, 181 cacertreq.filename, servercertreq.filename, false); 182 TLS_TEST_REG(perfectclient, false, 183 cacertreq.filename, clientcertreq.filename, false); 184 185 186 /* Some other CAs which are good */ 187 188 /* Basic:CA:critical */ 189 TLS_ROOT_REQ(cacert1req, 190 "UK", "qemu CA 1", NULL, NULL, NULL, NULL, 191 true, true, true, 192 false, false, 0, 193 false, false, NULL, NULL, 194 0, 0); 195 TLS_CERT_REQ(servercert1req, cacert1req, 196 "UK", "qemu.org", NULL, NULL, NULL, NULL, 197 true, true, false, 198 true, true, 199 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 200 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 201 0, 0); 202 203 /* Basic:CA:not-critical */ 204 TLS_ROOT_REQ(cacert2req, 205 "UK", "qemu CA 2", NULL, NULL, NULL, NULL, 206 true, false, true, 207 false, false, 0, 208 false, false, NULL, NULL, 209 0, 0); 210 TLS_CERT_REQ(servercert2req, cacert2req, 211 "UK", "qemu.org", NULL, NULL, NULL, NULL, 212 true, true, false, 213 true, true, 214 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 215 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 216 0, 0); 217 218 /* Key usage:cert-sign:critical */ 219 TLS_ROOT_REQ(cacert3req, 220 "UK", "qemu CA 3", NULL, NULL, NULL, NULL, 221 true, true, true, 222 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 223 false, false, NULL, NULL, 224 0, 0); 225 TLS_CERT_REQ(servercert3req, cacert3req, 226 "UK", "qemu.org", NULL, NULL, NULL, NULL, 227 true, true, false, 228 true, true, 229 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 230 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 231 0, 0); 232 233 TLS_TEST_REG(goodca1, true, 234 cacert1req.filename, servercert1req.filename, false); 235 TLS_TEST_REG(goodca2, true, 236 cacert2req.filename, servercert2req.filename, false); 237 TLS_TEST_REG(goodca3, true, 238 cacert3req.filename, servercert3req.filename, false); 239 240 /* Now some bad certs */ 241 242 /* Key usage:dig-sig:not-critical */ 243 TLS_ROOT_REQ(cacert4req, 244 "UK", "qemu CA 4", NULL, NULL, NULL, NULL, 245 true, true, true, 246 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, 247 false, false, NULL, NULL, 248 0, 0); 249 TLS_CERT_REQ(servercert4req, cacert4req, 250 "UK", "qemu.org", NULL, NULL, NULL, NULL, 251 true, true, false, 252 true, true, 253 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 254 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 255 0, 0); 256 /* no-basic */ 257 TLS_ROOT_REQ(cacert5req, 258 "UK", "qemu CA 5", NULL, NULL, NULL, NULL, 259 false, false, false, 260 false, false, 0, 261 false, false, NULL, NULL, 262 0, 0); 263 TLS_CERT_REQ(servercert5req, cacert5req, 264 "UK", "qemu.org", NULL, NULL, NULL, NULL, 265 true, true, false, 266 true, true, 267 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 268 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 269 0, 0); 270 /* Key usage:dig-sig:critical */ 271 TLS_ROOT_REQ(cacert6req, 272 "UK", "qemu CA 6", NULL, NULL, NULL, NULL, 273 true, true, true, 274 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE, 275 false, false, NULL, NULL, 276 0, 0); 277 TLS_CERT_REQ(servercert6req, cacert6req, 278 "UK", "qemu.org", NULL, NULL, NULL, NULL, 279 true, true, false, 280 true, true, 281 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 282 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 283 0, 0); 284 285 TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename, 286 true); 287 TLS_TEST_REG(badca2, true, 288 cacert5req.filename, servercert5req.filename, true); 289 TLS_TEST_REG(badca3, true, 290 cacert6req.filename, servercert6req.filename, true); 291 292 293 /* Various good servers */ 294 /* no usage or purpose */ 295 TLS_CERT_REQ(servercert7req, cacertreq, 296 "UK", "qemu", NULL, NULL, NULL, NULL, 297 true, true, false, 298 false, false, 0, 299 false, false, NULL, NULL, 300 0, 0); 301 /* usage:cert-sign+dig-sig+encipher:critical */ 302 TLS_CERT_REQ(servercert8req, cacertreq, 303 "UK", "qemu", NULL, NULL, NULL, NULL, 304 true, true, false, 305 true, true, 306 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | 307 GNUTLS_KEY_KEY_CERT_SIGN, 308 false, false, NULL, NULL, 309 0, 0); 310 /* usage:cert-sign:not-critical */ 311 TLS_CERT_REQ(servercert9req, cacertreq, 312 "UK", "qemu", NULL, NULL, NULL, NULL, 313 true, true, false, 314 true, false, GNUTLS_KEY_KEY_CERT_SIGN, 315 false, false, NULL, NULL, 316 0, 0); 317 /* purpose:server:critical */ 318 TLS_CERT_REQ(servercert10req, cacertreq, 319 "UK", "qemu", NULL, NULL, NULL, NULL, 320 true, true, false, 321 false, false, 0, 322 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 323 0, 0); 324 /* purpose:server:not-critical */ 325 TLS_CERT_REQ(servercert11req, cacertreq, 326 "UK", "qemu", NULL, NULL, NULL, NULL, 327 true, true, false, 328 false, false, 0, 329 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL, 330 0, 0); 331 /* purpose:client+server:critical */ 332 TLS_CERT_REQ(servercert12req, cacertreq, 333 "UK", "qemu", NULL, NULL, NULL, NULL, 334 true, true, false, 335 false, false, 0, 336 true, true, 337 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 338 0, 0); 339 /* purpose:client+server:not-critical */ 340 TLS_CERT_REQ(servercert13req, cacertreq, 341 "UK", "qemu", NULL, NULL, NULL, NULL, 342 true, true, false, 343 false, false, 0, 344 true, false, 345 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 346 0, 0); 347 348 TLS_TEST_REG(goodserver1, true, 349 cacertreq.filename, servercert7req.filename, false); 350 TLS_TEST_REG(goodserver2, true, 351 cacertreq.filename, servercert8req.filename, false); 352 TLS_TEST_REG(goodserver3, true, 353 cacertreq.filename, servercert9req.filename, false); 354 TLS_TEST_REG(goodserver4, true, 355 cacertreq.filename, servercert10req.filename, false); 356 TLS_TEST_REG(goodserver5, true, 357 cacertreq.filename, servercert11req.filename, false); 358 TLS_TEST_REG(goodserver6, true, 359 cacertreq.filename, servercert12req.filename, false); 360 TLS_TEST_REG(goodserver7, true, 361 cacertreq.filename, servercert13req.filename, false); 362 363 /* Bad servers */ 364 365 /* usage:cert-sign:critical */ 366 TLS_CERT_REQ(servercert14req, cacertreq, 367 "UK", "qemu", NULL, NULL, NULL, NULL, 368 true, true, false, 369 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 370 false, false, NULL, NULL, 371 0, 0); 372 /* purpose:client:critical */ 373 TLS_CERT_REQ(servercert15req, cacertreq, 374 "UK", "qemu", NULL, NULL, NULL, NULL, 375 true, true, false, 376 false, false, 0, 377 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 378 0, 0); 379 /* usage: none:critical */ 380 TLS_CERT_REQ(servercert16req, cacertreq, 381 "UK", "qemu", NULL, NULL, NULL, NULL, 382 true, true, false, 383 true, true, 0, 384 false, false, NULL, NULL, 385 0, 0); 386 387 TLS_TEST_REG(badserver1, true, 388 cacertreq.filename, servercert14req.filename, true); 389 TLS_TEST_REG(badserver2, true, 390 cacertreq.filename, servercert15req.filename, true); 391 TLS_TEST_REG(badserver3, true, 392 cacertreq.filename, servercert16req.filename, true); 393 394 395 396 /* Various good clients */ 397 /* no usage or purpose */ 398 TLS_CERT_REQ(clientcert1req, cacertreq, 399 "UK", "qemu", NULL, NULL, NULL, NULL, 400 true, true, false, 401 false, false, 0, 402 false, false, NULL, NULL, 403 0, 0); 404 /* usage:cert-sign+dig-sig+encipher:critical */ 405 TLS_CERT_REQ(clientcert2req, cacertreq, 406 "UK", "qemu", NULL, NULL, NULL, NULL, 407 true, true, false, 408 true, true, 409 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | 410 GNUTLS_KEY_KEY_CERT_SIGN, 411 false, false, NULL, NULL, 412 0, 0); 413 /* usage:cert-sign:not-critical */ 414 TLS_CERT_REQ(clientcert3req, cacertreq, 415 "UK", "qemu", NULL, NULL, NULL, NULL, 416 true, true, false, 417 true, false, GNUTLS_KEY_KEY_CERT_SIGN, 418 false, false, NULL, NULL, 419 0, 0); 420 /* purpose:client:critical */ 421 TLS_CERT_REQ(clientcert4req, cacertreq, 422 "UK", "qemu", NULL, NULL, NULL, NULL, 423 true, true, false, 424 false, false, 0, 425 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 426 0, 0); 427 /* purpose:client:not-critical */ 428 TLS_CERT_REQ(clientcert5req, cacertreq, 429 "UK", "qemu", NULL, NULL, NULL, NULL, 430 true, true, false, 431 false, false, 0, 432 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 433 0, 0); 434 /* purpose:client+client:critical */ 435 TLS_CERT_REQ(clientcert6req, cacertreq, 436 "UK", "qemu", NULL, NULL, NULL, NULL, 437 true, true, false, 438 false, false, 0, 439 true, true, 440 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 441 0, 0); 442 /* purpose:client+client:not-critical */ 443 TLS_CERT_REQ(clientcert7req, cacertreq, 444 "UK", "qemu", NULL, NULL, NULL, NULL, 445 true, true, false, 446 false, false, 0, 447 true, false, 448 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 449 0, 0); 450 451 TLS_TEST_REG(goodclient1, false, 452 cacertreq.filename, clientcert1req.filename, false); 453 TLS_TEST_REG(goodclient2, false, 454 cacertreq.filename, clientcert2req.filename, false); 455 TLS_TEST_REG(goodclient3, false, 456 cacertreq.filename, clientcert3req.filename, false); 457 TLS_TEST_REG(goodclient4, false, 458 cacertreq.filename, clientcert4req.filename, false); 459 TLS_TEST_REG(goodclient5, false, 460 cacertreq.filename, clientcert5req.filename, false); 461 TLS_TEST_REG(goodclient6, false, 462 cacertreq.filename, clientcert6req.filename, false); 463 TLS_TEST_REG(goodclient7, false, 464 cacertreq.filename, clientcert7req.filename, false); 465 466 /* Bad clients */ 467 468 /* usage:cert-sign:critical */ 469 TLS_CERT_REQ(clientcert8req, cacertreq, 470 "UK", "qemu", NULL, NULL, NULL, NULL, 471 true, true, false, 472 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 473 false, false, NULL, NULL, 474 0, 0); 475 /* purpose:client:critical */ 476 TLS_CERT_REQ(clientcert9req, cacertreq, 477 "UK", "qemu", NULL, NULL, NULL, NULL, 478 true, true, false, 479 false, false, 0, 480 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 481 0, 0); 482 /* usage: none:critical */ 483 TLS_CERT_REQ(clientcert10req, cacertreq, 484 "UK", "qemu", NULL, NULL, NULL, NULL, 485 true, true, false, 486 true, true, 0, 487 false, false, NULL, NULL, 488 0, 0); 489 490 TLS_TEST_REG(badclient1, false, 491 cacertreq.filename, clientcert8req.filename, true); 492 TLS_TEST_REG(badclient2, false, 493 cacertreq.filename, clientcert9req.filename, true); 494 TLS_TEST_REG(badclient3, false, 495 cacertreq.filename, clientcert10req.filename, true); 496 497 498 499 /* Expired stuff */ 500 501 TLS_ROOT_REQ(cacertexpreq, 502 "UK", "qemu", NULL, NULL, NULL, NULL, 503 true, true, true, 504 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 505 false, false, NULL, NULL, 506 0, -1); 507 TLS_CERT_REQ(servercertexpreq, cacertexpreq, 508 "UK", "qemu.org", NULL, NULL, NULL, NULL, 509 true, true, false, 510 true, true, 511 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 512 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 513 0, 0); 514 TLS_CERT_REQ(servercertexp1req, cacertreq, 515 "UK", "qemu", NULL, NULL, NULL, NULL, 516 true, true, false, 517 true, true, 518 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 519 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 520 0, -1); 521 TLS_CERT_REQ(clientcertexp1req, cacertreq, 522 "UK", "qemu", NULL, NULL, NULL, NULL, 523 true, true, false, 524 true, true, 525 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 526 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 527 0, -1); 528 529 TLS_TEST_REG(expired1, true, 530 cacertexpreq.filename, servercertexpreq.filename, true); 531 TLS_TEST_REG(expired2, true, 532 cacertreq.filename, servercertexp1req.filename, true); 533 TLS_TEST_REG(expired3, false, 534 cacertreq.filename, clientcertexp1req.filename, true); 535 536 537 /* Not activated stuff */ 538 539 TLS_ROOT_REQ(cacertnewreq, 540 "UK", "qemu", NULL, NULL, NULL, NULL, 541 true, true, true, 542 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 543 false, false, NULL, NULL, 544 1, 2); 545 TLS_CERT_REQ(servercertnewreq, cacertnewreq, 546 "UK", "qemu", NULL, NULL, NULL, NULL, 547 true, true, false, 548 true, true, 549 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 550 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 551 0, 0); 552 TLS_CERT_REQ(servercertnew1req, cacertreq, 553 "UK", "qemu", NULL, NULL, NULL, NULL, 554 true, true, false, 555 true, true, 556 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 557 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 558 1, 2); 559 TLS_CERT_REQ(clientcertnew1req, cacertreq, 560 "UK", "qemu", NULL, NULL, NULL, NULL, 561 true, true, false, 562 true, true, 563 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 564 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 565 1, 2); 566 567 TLS_TEST_REG(inactive1, true, 568 cacertnewreq.filename, servercertnewreq.filename, true); 569 TLS_TEST_REG(inactive2, true, 570 cacertreq.filename, servercertnew1req.filename, true); 571 TLS_TEST_REG(inactive3, false, 572 cacertreq.filename, clientcertnew1req.filename, true); 573 574 TLS_ROOT_REQ(cacertrootreq, 575 "UK", "qemu root", NULL, NULL, NULL, NULL, 576 true, true, true, 577 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 578 false, false, NULL, NULL, 579 0, 0); 580 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, 581 "UK", "qemu level 1a", NULL, NULL, NULL, NULL, 582 true, true, true, 583 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 584 false, false, NULL, NULL, 585 0, 0); 586 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq, 587 "UK", "qemu level 1b", NULL, NULL, NULL, NULL, 588 true, true, true, 589 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 590 false, false, NULL, NULL, 591 0, 0); 592 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, 593 "UK", "qemu level 2a", NULL, NULL, NULL, NULL, 594 true, true, true, 595 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 596 false, false, NULL, NULL, 597 0, 0); 598 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq, 599 "UK", "qemu.org", NULL, NULL, NULL, NULL, 600 true, true, false, 601 true, true, 602 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 603 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 604 0, 0); 605 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, 606 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL, 607 true, true, false, 608 true, true, 609 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 610 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 611 0, 0); 612 613 gnutls_x509_crt_t certchain[] = { 614 cacertrootreq.crt, 615 cacertlevel1areq.crt, 616 cacertlevel1breq.crt, 617 cacertlevel2areq.crt, 618 }; 619 620 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem", 621 certchain, 622 G_N_ELEMENTS(certchain)); 623 624 TLS_TEST_REG(chain1, true, 625 WORKDIR "cacertchain-ctx.pem", 626 servercertlevel3areq.filename, false); 627 TLS_TEST_REG(chain2, false, 628 WORKDIR "cacertchain-ctx.pem", 629 clientcertlevel2breq.filename, false); 630 631 /* Some missing certs - first two are fatal, the last 632 * is ok 633 */ 634 TLS_TEST_REG(missingca, true, 635 "cacertdoesnotexist.pem", 636 servercert1req.filename, true); 637 TLS_TEST_REG(missingserver, true, 638 cacert1req.filename, 639 "servercertdoesnotexist.pem", true); 640 TLS_TEST_REG(missingclient, false, 641 cacert1req.filename, 642 "clientcertdoesnotexist.pem", false); 643 644 ret = g_test_run(); 645 646 test_tls_discard_cert(&cacertreq); 647 test_tls_discard_cert(&cacert1req); 648 test_tls_discard_cert(&cacert2req); 649 test_tls_discard_cert(&cacert3req); 650 test_tls_discard_cert(&cacert4req); 651 test_tls_discard_cert(&cacert5req); 652 test_tls_discard_cert(&cacert6req); 653 654 test_tls_discard_cert(&servercertreq); 655 test_tls_discard_cert(&servercert1req); 656 test_tls_discard_cert(&servercert2req); 657 test_tls_discard_cert(&servercert3req); 658 test_tls_discard_cert(&servercert4req); 659 test_tls_discard_cert(&servercert5req); 660 test_tls_discard_cert(&servercert6req); 661 test_tls_discard_cert(&servercert7req); 662 test_tls_discard_cert(&servercert8req); 663 test_tls_discard_cert(&servercert9req); 664 test_tls_discard_cert(&servercert10req); 665 test_tls_discard_cert(&servercert11req); 666 test_tls_discard_cert(&servercert12req); 667 test_tls_discard_cert(&servercert13req); 668 test_tls_discard_cert(&servercert14req); 669 test_tls_discard_cert(&servercert15req); 670 test_tls_discard_cert(&servercert16req); 671 672 test_tls_discard_cert(&clientcertreq); 673 test_tls_discard_cert(&clientcert1req); 674 test_tls_discard_cert(&clientcert2req); 675 test_tls_discard_cert(&clientcert3req); 676 test_tls_discard_cert(&clientcert4req); 677 test_tls_discard_cert(&clientcert5req); 678 test_tls_discard_cert(&clientcert6req); 679 test_tls_discard_cert(&clientcert7req); 680 test_tls_discard_cert(&clientcert8req); 681 test_tls_discard_cert(&clientcert9req); 682 test_tls_discard_cert(&clientcert10req); 683 684 test_tls_discard_cert(&cacertexpreq); 685 test_tls_discard_cert(&servercertexpreq); 686 test_tls_discard_cert(&servercertexp1req); 687 test_tls_discard_cert(&clientcertexp1req); 688 689 test_tls_discard_cert(&cacertnewreq); 690 test_tls_discard_cert(&servercertnewreq); 691 test_tls_discard_cert(&servercertnew1req); 692 test_tls_discard_cert(&clientcertnew1req); 693 694 test_tls_discard_cert(&cacertrootreq); 695 test_tls_discard_cert(&cacertlevel1areq); 696 test_tls_discard_cert(&cacertlevel1breq); 697 test_tls_discard_cert(&cacertlevel2areq); 698 test_tls_discard_cert(&servercertlevel3areq); 699 test_tls_discard_cert(&clientcertlevel2breq); 700 unlink(WORKDIR "cacertchain-ctx.pem"); 701 702 test_tls_cleanup(KEYFILE); 703 rmdir(WORKDIR); 704 705 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; 706 } 707