1 /* 2 * Copyright (C) 2015 Red Hat, Inc. 3 * 4 * This library is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU Lesser General Public 6 * License as published by the Free Software Foundation; either 7 * version 2.1 of the License, or (at your option) any later version. 8 * 9 * This library is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 * Lesser General Public License for more details. 13 * 14 * You should have received a copy of the GNU Lesser General Public 15 * License along with this library. If not, see 16 * <http://www.gnu.org/licenses/>. 17 * 18 * Author: Daniel P. Berrange <berrange@redhat.com> 19 */ 20 21 #include "qemu/osdep.h" 22 23 #include "crypto-tls-x509-helpers.h" 24 #include "crypto/tlscredsx509.h" 25 #include "qapi/error.h" 26 #include "qemu/module.h" 27 28 #ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT 29 30 #define WORKDIR "tests/test-crypto-tlscredsx509-work/" 31 #define KEYFILE WORKDIR "key-ctx.pem" 32 33 struct QCryptoTLSCredsTestData { 34 bool isServer; 35 const char *cacrt; 36 const char *crt; 37 bool expectFail; 38 }; 39 40 41 static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint, 42 const char *certdir, 43 Error **errp) 44 { 45 Object *parent = object_get_objects_root(); 46 Object *creds = object_new_with_props( 47 TYPE_QCRYPTO_TLS_CREDS_X509, 48 parent, 49 "testtlscreds", 50 errp, 51 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ? 52 "server" : "client"), 53 "dir", certdir, 54 "verify-peer", "yes", 55 "sanity-check", "yes", 56 NULL); 57 58 if (!creds) { 59 return NULL; 60 } 61 return QCRYPTO_TLS_CREDS(creds); 62 } 63 64 /* 65 * This tests sanity checking of our own certificates 66 * 67 * The code being tested is used when TLS creds are created, 68 * and aim to ensure QMEU has been configured with sane 69 * certificates. This allows us to give much much much 70 * clearer error messages to the admin when they misconfigure 71 * things. 72 */ 73 static void test_tls_creds(const void *opaque) 74 { 75 struct QCryptoTLSCredsTestData *data = 76 (struct QCryptoTLSCredsTestData *)opaque; 77 QCryptoTLSCreds *creds; 78 79 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/" 80 mkdir(CERT_DIR, 0700); 81 82 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT); 83 if (data->isServer) { 84 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT); 85 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY); 86 } else { 87 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT); 88 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY); 89 } 90 91 if (access(data->cacrt, R_OK) == 0) { 92 g_assert(link(data->cacrt, 93 CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0); 94 } 95 if (data->isServer) { 96 if (access(data->crt, R_OK) == 0) { 97 g_assert(link(data->crt, 98 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0); 99 } 100 g_assert(link(KEYFILE, 101 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0); 102 } else { 103 if (access(data->crt, R_OK) == 0) { 104 g_assert(link(data->crt, 105 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0); 106 } 107 g_assert(link(KEYFILE, 108 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0); 109 } 110 111 creds = test_tls_creds_create( 112 (data->isServer ? 113 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER : 114 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT), 115 CERT_DIR, 116 data->expectFail ? NULL : &error_abort); 117 118 if (data->expectFail) { 119 g_assert(creds == NULL); 120 } else { 121 g_assert(creds != NULL); 122 } 123 124 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT); 125 if (data->isServer) { 126 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT); 127 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY); 128 } else { 129 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT); 130 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY); 131 } 132 rmdir(CERT_DIR); 133 if (creds) { 134 object_unparent(OBJECT(creds)); 135 } 136 } 137 138 int main(int argc, char **argv) 139 { 140 int ret; 141 142 module_call_init(MODULE_INIT_QOM); 143 g_test_init(&argc, &argv, NULL); 144 g_setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); 145 146 mkdir(WORKDIR, 0700); 147 148 test_tls_init(KEYFILE); 149 150 # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \ 151 struct QCryptoTLSCredsTestData name = { \ 152 isServer, caCrt, crt, expectFail \ 153 }; \ 154 g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \ 155 &name, test_tls_creds); \ 156 157 /* A perfect CA, perfect client & perfect server */ 158 159 /* Basic:CA:critical */ 160 TLS_ROOT_REQ(cacertreq, 161 "UK", "qemu CA", NULL, NULL, NULL, NULL, 162 true, true, true, 163 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 164 false, false, NULL, NULL, 165 0, 0); 166 167 TLS_CERT_REQ(servercertreq, cacertreq, 168 "UK", "qemu.org", NULL, NULL, NULL, NULL, 169 true, true, false, 170 true, true, 171 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 172 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 173 0, 0); 174 TLS_CERT_REQ(clientcertreq, cacertreq, 175 "UK", "qemu", NULL, NULL, NULL, NULL, 176 true, true, false, 177 true, true, 178 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 179 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 180 0, 0); 181 182 TLS_TEST_REG(perfectserver, true, 183 cacertreq.filename, servercertreq.filename, false); 184 TLS_TEST_REG(perfectclient, false, 185 cacertreq.filename, clientcertreq.filename, false); 186 187 188 /* Some other CAs which are good */ 189 190 /* Basic:CA:critical */ 191 TLS_ROOT_REQ(cacert1req, 192 "UK", "qemu CA 1", NULL, NULL, NULL, NULL, 193 true, true, true, 194 false, false, 0, 195 false, false, NULL, NULL, 196 0, 0); 197 TLS_CERT_REQ(servercert1req, cacert1req, 198 "UK", "qemu.org", NULL, NULL, NULL, NULL, 199 true, true, false, 200 true, true, 201 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 202 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 203 0, 0); 204 205 /* Basic:CA:not-critical */ 206 TLS_ROOT_REQ(cacert2req, 207 "UK", "qemu CA 2", NULL, NULL, NULL, NULL, 208 true, false, true, 209 false, false, 0, 210 false, false, NULL, NULL, 211 0, 0); 212 TLS_CERT_REQ(servercert2req, cacert2req, 213 "UK", "qemu.org", NULL, NULL, NULL, NULL, 214 true, true, false, 215 true, true, 216 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 217 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 218 0, 0); 219 220 /* Key usage:cert-sign:critical */ 221 TLS_ROOT_REQ(cacert3req, 222 "UK", "qemu CA 3", NULL, NULL, NULL, NULL, 223 true, true, true, 224 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 225 false, false, NULL, NULL, 226 0, 0); 227 TLS_CERT_REQ(servercert3req, cacert3req, 228 "UK", "qemu.org", NULL, NULL, NULL, NULL, 229 true, true, false, 230 true, true, 231 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 232 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 233 0, 0); 234 235 TLS_TEST_REG(goodca1, true, 236 cacert1req.filename, servercert1req.filename, false); 237 TLS_TEST_REG(goodca2, true, 238 cacert2req.filename, servercert2req.filename, false); 239 TLS_TEST_REG(goodca3, true, 240 cacert3req.filename, servercert3req.filename, false); 241 242 /* Now some bad certs */ 243 244 /* Key usage:dig-sig:not-critical */ 245 TLS_ROOT_REQ(cacert4req, 246 "UK", "qemu CA 4", NULL, NULL, NULL, NULL, 247 true, true, true, 248 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, 249 false, false, NULL, NULL, 250 0, 0); 251 TLS_CERT_REQ(servercert4req, cacert4req, 252 "UK", "qemu.org", NULL, NULL, NULL, NULL, 253 true, true, false, 254 true, true, 255 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 256 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 257 0, 0); 258 /* no-basic */ 259 TLS_ROOT_REQ(cacert5req, 260 "UK", "qemu CA 5", NULL, NULL, NULL, NULL, 261 false, false, false, 262 false, false, 0, 263 false, false, NULL, NULL, 264 0, 0); 265 TLS_CERT_REQ(servercert5req, cacert5req, 266 "UK", "qemu.org", NULL, NULL, NULL, NULL, 267 true, true, false, 268 true, true, 269 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 270 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 271 0, 0); 272 /* Key usage:dig-sig:critical */ 273 TLS_ROOT_REQ(cacert6req, 274 "UK", "qemu CA 6", NULL, NULL, NULL, NULL, 275 true, true, true, 276 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE, 277 false, false, NULL, NULL, 278 0, 0); 279 TLS_CERT_REQ(servercert6req, cacert6req, 280 "UK", "qemu.org", NULL, NULL, NULL, NULL, 281 true, true, false, 282 true, true, 283 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 284 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 285 0, 0); 286 287 TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename, 288 true); 289 TLS_TEST_REG(badca2, true, 290 cacert5req.filename, servercert5req.filename, true); 291 TLS_TEST_REG(badca3, true, 292 cacert6req.filename, servercert6req.filename, true); 293 294 295 /* Various good servers */ 296 /* no usage or purpose */ 297 TLS_CERT_REQ(servercert7req, cacertreq, 298 "UK", "qemu", NULL, NULL, NULL, NULL, 299 true, true, false, 300 false, false, 0, 301 false, false, NULL, NULL, 302 0, 0); 303 /* usage:cert-sign+dig-sig+encipher:critical */ 304 TLS_CERT_REQ(servercert8req, cacertreq, 305 "UK", "qemu", NULL, NULL, NULL, NULL, 306 true, true, false, 307 true, true, 308 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | 309 GNUTLS_KEY_KEY_CERT_SIGN, 310 false, false, NULL, NULL, 311 0, 0); 312 /* usage:cert-sign:not-critical */ 313 TLS_CERT_REQ(servercert9req, cacertreq, 314 "UK", "qemu", NULL, NULL, NULL, NULL, 315 true, true, false, 316 true, false, GNUTLS_KEY_KEY_CERT_SIGN, 317 false, false, NULL, NULL, 318 0, 0); 319 /* purpose:server:critical */ 320 TLS_CERT_REQ(servercert10req, cacertreq, 321 "UK", "qemu", NULL, NULL, NULL, NULL, 322 true, true, false, 323 false, false, 0, 324 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 325 0, 0); 326 /* purpose:server:not-critical */ 327 TLS_CERT_REQ(servercert11req, cacertreq, 328 "UK", "qemu", NULL, NULL, NULL, NULL, 329 true, true, false, 330 false, false, 0, 331 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL, 332 0, 0); 333 /* purpose:client+server:critical */ 334 TLS_CERT_REQ(servercert12req, cacertreq, 335 "UK", "qemu", NULL, NULL, NULL, NULL, 336 true, true, false, 337 false, false, 0, 338 true, true, 339 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 340 0, 0); 341 /* purpose:client+server:not-critical */ 342 TLS_CERT_REQ(servercert13req, cacertreq, 343 "UK", "qemu", NULL, NULL, NULL, NULL, 344 true, true, false, 345 false, false, 0, 346 true, false, 347 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 348 0, 0); 349 350 TLS_TEST_REG(goodserver1, true, 351 cacertreq.filename, servercert7req.filename, false); 352 TLS_TEST_REG(goodserver2, true, 353 cacertreq.filename, servercert8req.filename, false); 354 TLS_TEST_REG(goodserver3, true, 355 cacertreq.filename, servercert9req.filename, false); 356 TLS_TEST_REG(goodserver4, true, 357 cacertreq.filename, servercert10req.filename, false); 358 TLS_TEST_REG(goodserver5, true, 359 cacertreq.filename, servercert11req.filename, false); 360 TLS_TEST_REG(goodserver6, true, 361 cacertreq.filename, servercert12req.filename, false); 362 TLS_TEST_REG(goodserver7, true, 363 cacertreq.filename, servercert13req.filename, false); 364 365 /* Bad servers */ 366 367 /* usage:cert-sign:critical */ 368 TLS_CERT_REQ(servercert14req, cacertreq, 369 "UK", "qemu", NULL, NULL, NULL, NULL, 370 true, true, false, 371 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 372 false, false, NULL, NULL, 373 0, 0); 374 /* purpose:client:critical */ 375 TLS_CERT_REQ(servercert15req, cacertreq, 376 "UK", "qemu", NULL, NULL, NULL, NULL, 377 true, true, false, 378 false, false, 0, 379 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 380 0, 0); 381 /* usage: none:critical */ 382 TLS_CERT_REQ(servercert16req, cacertreq, 383 "UK", "qemu", NULL, NULL, NULL, NULL, 384 true, true, false, 385 true, true, 0, 386 false, false, NULL, NULL, 387 0, 0); 388 389 TLS_TEST_REG(badserver1, true, 390 cacertreq.filename, servercert14req.filename, true); 391 TLS_TEST_REG(badserver2, true, 392 cacertreq.filename, servercert15req.filename, true); 393 TLS_TEST_REG(badserver3, true, 394 cacertreq.filename, servercert16req.filename, true); 395 396 397 398 /* Various good clients */ 399 /* no usage or purpose */ 400 TLS_CERT_REQ(clientcert1req, cacertreq, 401 "UK", "qemu", NULL, NULL, NULL, NULL, 402 true, true, false, 403 false, false, 0, 404 false, false, NULL, NULL, 405 0, 0); 406 /* usage:cert-sign+dig-sig+encipher:critical */ 407 TLS_CERT_REQ(clientcert2req, cacertreq, 408 "UK", "qemu", NULL, NULL, NULL, NULL, 409 true, true, false, 410 true, true, 411 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | 412 GNUTLS_KEY_KEY_CERT_SIGN, 413 false, false, NULL, NULL, 414 0, 0); 415 /* usage:cert-sign:not-critical */ 416 TLS_CERT_REQ(clientcert3req, cacertreq, 417 "UK", "qemu", NULL, NULL, NULL, NULL, 418 true, true, false, 419 true, false, GNUTLS_KEY_KEY_CERT_SIGN, 420 false, false, NULL, NULL, 421 0, 0); 422 /* purpose:client:critical */ 423 TLS_CERT_REQ(clientcert4req, cacertreq, 424 "UK", "qemu", NULL, NULL, NULL, NULL, 425 true, true, false, 426 false, false, 0, 427 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 428 0, 0); 429 /* purpose:client:not-critical */ 430 TLS_CERT_REQ(clientcert5req, cacertreq, 431 "UK", "qemu", NULL, NULL, NULL, NULL, 432 true, true, false, 433 false, false, 0, 434 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 435 0, 0); 436 /* purpose:client+client:critical */ 437 TLS_CERT_REQ(clientcert6req, cacertreq, 438 "UK", "qemu", NULL, NULL, NULL, NULL, 439 true, true, false, 440 false, false, 0, 441 true, true, 442 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 443 0, 0); 444 /* purpose:client+client:not-critical */ 445 TLS_CERT_REQ(clientcert7req, cacertreq, 446 "UK", "qemu", NULL, NULL, NULL, NULL, 447 true, true, false, 448 false, false, 0, 449 true, false, 450 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 451 0, 0); 452 453 TLS_TEST_REG(goodclient1, false, 454 cacertreq.filename, clientcert1req.filename, false); 455 TLS_TEST_REG(goodclient2, false, 456 cacertreq.filename, clientcert2req.filename, false); 457 TLS_TEST_REG(goodclient3, false, 458 cacertreq.filename, clientcert3req.filename, false); 459 TLS_TEST_REG(goodclient4, false, 460 cacertreq.filename, clientcert4req.filename, false); 461 TLS_TEST_REG(goodclient5, false, 462 cacertreq.filename, clientcert5req.filename, false); 463 TLS_TEST_REG(goodclient6, false, 464 cacertreq.filename, clientcert6req.filename, false); 465 TLS_TEST_REG(goodclient7, false, 466 cacertreq.filename, clientcert7req.filename, false); 467 468 /* Bad clients */ 469 470 /* usage:cert-sign:critical */ 471 TLS_CERT_REQ(clientcert8req, cacertreq, 472 "UK", "qemu", NULL, NULL, NULL, NULL, 473 true, true, false, 474 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 475 false, false, NULL, NULL, 476 0, 0); 477 /* purpose:client:critical */ 478 TLS_CERT_REQ(clientcert9req, cacertreq, 479 "UK", "qemu", NULL, NULL, NULL, NULL, 480 true, true, false, 481 false, false, 0, 482 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 483 0, 0); 484 /* usage: none:critical */ 485 TLS_CERT_REQ(clientcert10req, cacertreq, 486 "UK", "qemu", NULL, NULL, NULL, NULL, 487 true, true, false, 488 true, true, 0, 489 false, false, NULL, NULL, 490 0, 0); 491 492 TLS_TEST_REG(badclient1, false, 493 cacertreq.filename, clientcert8req.filename, true); 494 TLS_TEST_REG(badclient2, false, 495 cacertreq.filename, clientcert9req.filename, true); 496 TLS_TEST_REG(badclient3, false, 497 cacertreq.filename, clientcert10req.filename, true); 498 499 500 501 /* Expired stuff */ 502 503 TLS_ROOT_REQ(cacertexpreq, 504 "UK", "qemu", NULL, NULL, NULL, NULL, 505 true, true, true, 506 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 507 false, false, NULL, NULL, 508 0, -1); 509 TLS_CERT_REQ(servercertexpreq, cacertexpreq, 510 "UK", "qemu.org", NULL, NULL, NULL, NULL, 511 true, true, false, 512 true, true, 513 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 514 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 515 0, 0); 516 TLS_CERT_REQ(servercertexp1req, cacertreq, 517 "UK", "qemu", NULL, NULL, NULL, NULL, 518 true, true, false, 519 true, true, 520 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 521 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 522 0, -1); 523 TLS_CERT_REQ(clientcertexp1req, cacertreq, 524 "UK", "qemu", NULL, NULL, NULL, NULL, 525 true, true, false, 526 true, true, 527 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 528 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 529 0, -1); 530 531 TLS_TEST_REG(expired1, true, 532 cacertexpreq.filename, servercertexpreq.filename, true); 533 TLS_TEST_REG(expired2, true, 534 cacertreq.filename, servercertexp1req.filename, true); 535 TLS_TEST_REG(expired3, false, 536 cacertreq.filename, clientcertexp1req.filename, true); 537 538 539 /* Not activated stuff */ 540 541 TLS_ROOT_REQ(cacertnewreq, 542 "UK", "qemu", NULL, NULL, NULL, NULL, 543 true, true, true, 544 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 545 false, false, NULL, NULL, 546 1, 2); 547 TLS_CERT_REQ(servercertnewreq, cacertnewreq, 548 "UK", "qemu", NULL, NULL, NULL, NULL, 549 true, true, false, 550 true, true, 551 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 552 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 553 0, 0); 554 TLS_CERT_REQ(servercertnew1req, cacertreq, 555 "UK", "qemu", NULL, NULL, NULL, NULL, 556 true, true, false, 557 true, true, 558 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 559 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 560 1, 2); 561 TLS_CERT_REQ(clientcertnew1req, cacertreq, 562 "UK", "qemu", NULL, NULL, NULL, NULL, 563 true, true, false, 564 true, true, 565 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 566 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 567 1, 2); 568 569 TLS_TEST_REG(inactive1, true, 570 cacertnewreq.filename, servercertnewreq.filename, true); 571 TLS_TEST_REG(inactive2, true, 572 cacertreq.filename, servercertnew1req.filename, true); 573 TLS_TEST_REG(inactive3, false, 574 cacertreq.filename, clientcertnew1req.filename, true); 575 576 TLS_ROOT_REQ(cacertrootreq, 577 "UK", "qemu root", NULL, NULL, NULL, NULL, 578 true, true, true, 579 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 580 false, false, NULL, NULL, 581 0, 0); 582 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, 583 "UK", "qemu level 1a", NULL, NULL, NULL, NULL, 584 true, true, true, 585 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 586 false, false, NULL, NULL, 587 0, 0); 588 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq, 589 "UK", "qemu level 1b", NULL, NULL, NULL, NULL, 590 true, true, true, 591 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 592 false, false, NULL, NULL, 593 0, 0); 594 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, 595 "UK", "qemu level 2a", NULL, NULL, NULL, NULL, 596 true, true, true, 597 true, true, GNUTLS_KEY_KEY_CERT_SIGN, 598 false, false, NULL, NULL, 599 0, 0); 600 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq, 601 "UK", "qemu.org", NULL, NULL, NULL, NULL, 602 true, true, false, 603 true, true, 604 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 605 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 606 0, 0); 607 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, 608 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL, 609 true, true, false, 610 true, true, 611 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 612 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 613 0, 0); 614 615 gnutls_x509_crt_t certchain[] = { 616 cacertrootreq.crt, 617 cacertlevel1areq.crt, 618 cacertlevel1breq.crt, 619 cacertlevel2areq.crt, 620 }; 621 622 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem", 623 certchain, 624 G_N_ELEMENTS(certchain)); 625 626 TLS_TEST_REG(chain1, true, 627 WORKDIR "cacertchain-ctx.pem", 628 servercertlevel3areq.filename, false); 629 TLS_TEST_REG(chain2, false, 630 WORKDIR "cacertchain-ctx.pem", 631 clientcertlevel2breq.filename, false); 632 633 /* Some missing certs - first two are fatal, the last 634 * is ok 635 */ 636 TLS_TEST_REG(missingca, true, 637 "cacertdoesnotexist.pem", 638 servercert1req.filename, true); 639 TLS_TEST_REG(missingserver, true, 640 cacert1req.filename, 641 "servercertdoesnotexist.pem", true); 642 TLS_TEST_REG(missingclient, false, 643 cacert1req.filename, 644 "clientcertdoesnotexist.pem", false); 645 646 ret = g_test_run(); 647 648 test_tls_discard_cert(&cacertreq); 649 test_tls_discard_cert(&cacert1req); 650 test_tls_discard_cert(&cacert2req); 651 test_tls_discard_cert(&cacert3req); 652 test_tls_discard_cert(&cacert4req); 653 test_tls_discard_cert(&cacert5req); 654 test_tls_discard_cert(&cacert6req); 655 656 test_tls_discard_cert(&servercertreq); 657 test_tls_discard_cert(&servercert1req); 658 test_tls_discard_cert(&servercert2req); 659 test_tls_discard_cert(&servercert3req); 660 test_tls_discard_cert(&servercert4req); 661 test_tls_discard_cert(&servercert5req); 662 test_tls_discard_cert(&servercert6req); 663 test_tls_discard_cert(&servercert7req); 664 test_tls_discard_cert(&servercert8req); 665 test_tls_discard_cert(&servercert9req); 666 test_tls_discard_cert(&servercert10req); 667 test_tls_discard_cert(&servercert11req); 668 test_tls_discard_cert(&servercert12req); 669 test_tls_discard_cert(&servercert13req); 670 test_tls_discard_cert(&servercert14req); 671 test_tls_discard_cert(&servercert15req); 672 test_tls_discard_cert(&servercert16req); 673 674 test_tls_discard_cert(&clientcertreq); 675 test_tls_discard_cert(&clientcert1req); 676 test_tls_discard_cert(&clientcert2req); 677 test_tls_discard_cert(&clientcert3req); 678 test_tls_discard_cert(&clientcert4req); 679 test_tls_discard_cert(&clientcert5req); 680 test_tls_discard_cert(&clientcert6req); 681 test_tls_discard_cert(&clientcert7req); 682 test_tls_discard_cert(&clientcert8req); 683 test_tls_discard_cert(&clientcert9req); 684 test_tls_discard_cert(&clientcert10req); 685 686 test_tls_discard_cert(&cacertexpreq); 687 test_tls_discard_cert(&servercertexpreq); 688 test_tls_discard_cert(&servercertexp1req); 689 test_tls_discard_cert(&clientcertexp1req); 690 691 test_tls_discard_cert(&cacertnewreq); 692 test_tls_discard_cert(&servercertnewreq); 693 test_tls_discard_cert(&servercertnew1req); 694 test_tls_discard_cert(&clientcertnew1req); 695 696 test_tls_discard_cert(&cacertrootreq); 697 test_tls_discard_cert(&cacertlevel1areq); 698 test_tls_discard_cert(&cacertlevel1breq); 699 test_tls_discard_cert(&cacertlevel2areq); 700 test_tls_discard_cert(&servercertlevel3areq); 701 test_tls_discard_cert(&clientcertlevel2breq); 702 unlink(WORKDIR "cacertchain-ctx.pem"); 703 704 test_tls_cleanup(KEYFILE); 705 rmdir(WORKDIR); 706 707 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; 708 } 709 710 #else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */ 711 712 int 713 main(void) 714 { 715 return EXIT_SUCCESS; 716 } 717 718 #endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */ 719