@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 821 lines 30.2 KB
Raw
1 /*
2 * Copyright (C) 2015 Red Hat, Inc.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library. If not, see
16 * <http://www.gnu.org/licenses/>.
17 *
18 * Author: Daniel P. Berrange <berrange@redhat.com>
19 */
20
21 #include "qemu/osdep.h"
22
23 #include "crypto-tls-x509-helpers.h"
24 #include "crypto/tlscredsx509.h"
25 #include "qapi/error.h"
26 #include "qemu/module.h"
27
28 #define WORKDIR "tests/test-crypto-tlscredsx509-work/"
29 #define KEYFILE WORKDIR "key-ctx.pem"
30
31 struct QCryptoTLSCredsTestData {
32 bool isServer;
33 const char *cacrt;
34 const char *crt;
35 bool expectFail;
36 };
37
38
39 static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
40 const char *certdir,
41 Error **errp)
42 {
43 Object *parent = object_get_objects_root();
44 Object *creds = object_new_with_props(
45 TYPE_QCRYPTO_TLS_CREDS_X509,
46 parent,
47 "testtlscreds",
48 errp,
49 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
50 "server" : "client"),
51 "dir", certdir,
52 "verify-peer", "yes",
53 "sanity-check", "yes",
54 NULL);
55
56 if (!creds) {
57 return NULL;
58 }
59 return QCRYPTO_TLS_CREDS(creds);
60 }
61
62 /*
63 * This tests sanity checking of our own certificates
64 *
65 * The code being tested is used when TLS creds are created,
66 * and aim to ensure QMEU has been configured with sane
67 * certificates. This allows us to give much much much
68 * clearer error messages to the admin when they misconfigure
69 * things.
70 */
71 static void test_tls_creds(const void *opaque)
72 {
73 struct QCryptoTLSCredsTestData *data =
74 (struct QCryptoTLSCredsTestData *)opaque;
75 QCryptoTLSCreds *creds;
76 Error *err = NULL;
77
78 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
79 g_mkdir_with_parents(CERT_DIR, 0700);
80
81 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
82 if (data->isServer) {
83 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
84 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
85 } else {
86 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
87 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
88 }
89
90 if (access(data->cacrt, R_OK) == 0) {
91 g_assert(link(data->cacrt,
92 CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
93 }
94 if (data->isServer) {
95 if (access(data->crt, R_OK) == 0) {
96 g_assert(link(data->crt,
97 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
98 g_assert(link(KEYFILE,
99 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
100 }
101 } else {
102 if (access(data->crt, R_OK) == 0) {
103 g_assert(link(data->crt,
104 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
105 g_assert(link(KEYFILE,
106 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
107 }
108 }
109
110 creds = test_tls_creds_create(
111 (data->isServer ?
112 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
113 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
114 CERT_DIR,
115 data->expectFail ? &err : &error_abort);
116
117 if (data->expectFail) {
118 g_assert(creds == NULL);
119 g_assert(err != NULL);
120 error_free(err);
121 } else {
122 g_assert(creds != NULL);
123 }
124
125 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
126 if (data->isServer) {
127 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
128 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
129 } else {
130 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
131 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
132 }
133 rmdir(CERT_DIR);
134 if (creds) {
135 object_unparent(OBJECT(creds));
136 }
137 }
138
139 int main(int argc, char **argv)
140 {
141 int ret;
142
143 module_call_init(MODULE_INIT_QOM);
144 g_test_init(&argc, &argv, NULL);
145 g_setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
146
147 g_mkdir_with_parents(WORKDIR, 0700);
148
149 test_tls_init(KEYFILE);
150
151 # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \
152 struct QCryptoTLSCredsTestData name = { \
153 isServer, caCrt, crt, expectFail \
154 }; \
155 g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \
156 &name, test_tls_creds); \
157
158 /* A perfect CA, perfect client & perfect server */
159
160 /* Basic:CA:critical */
161 TLS_ROOT_REQ(cacertreq,
162 "UK", "qemu CA", NULL, NULL, NULL, NULL,
163 true, true, true,
164 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
165 false, false, NULL, NULL,
166 0, 0);
167
168 TLS_CERT_REQ(servercertreq, cacertreq,
169 "UK", "qemu.org", NULL, NULL, NULL, NULL,
170 true, true, false,
171 true, true,
172 GNUTLS_KEY_DIGITAL_SIGNATURE,
173 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
174 0, 0);
175 TLS_CERT_REQ(clientcertreq, cacertreq,
176 "UK", "qemu", NULL, NULL, NULL, NULL,
177 true, true, false,
178 true, true,
179 GNUTLS_KEY_DIGITAL_SIGNATURE,
180 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
181 0, 0);
182
183 TLS_TEST_REG(perfectserver, true,
184 cacertreq.filename, servercertreq.filename, false);
185 TLS_TEST_REG(perfectclient, false,
186 cacertreq.filename, clientcertreq.filename, false);
187
188
189 /* Some other CAs which are good */
190
191 /* Basic:CA:critical */
192 TLS_ROOT_REQ(cacert1req,
193 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
194 true, true, true,
195 false, false, 0,
196 false, false, NULL, NULL,
197 0, 0);
198 TLS_CERT_REQ(servercert1req, cacert1req,
199 "UK", "qemu.org", NULL, NULL, NULL, NULL,
200 true, true, false,
201 true, true,
202 GNUTLS_KEY_DIGITAL_SIGNATURE,
203 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
204 0, 0);
205
206 /* Basic:CA:not-critical */
207 TLS_ROOT_REQ(cacert2req,
208 "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
209 true, false, true,
210 false, false, 0,
211 false, false, NULL, NULL,
212 0, 0);
213 TLS_CERT_REQ(servercert2req, cacert2req,
214 "UK", "qemu.org", NULL, NULL, NULL, NULL,
215 true, true, false,
216 true, true,
217 GNUTLS_KEY_DIGITAL_SIGNATURE,
218 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
219 0, 0);
220
221 /* Key usage:cert-sign:critical */
222 TLS_ROOT_REQ(cacert3req,
223 "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
224 true, true, true,
225 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
226 false, false, NULL, NULL,
227 0, 0);
228 TLS_CERT_REQ(servercert3req, cacert3req,
229 "UK", "qemu.org", NULL, NULL, NULL, NULL,
230 true, true, false,
231 true, true,
232 GNUTLS_KEY_DIGITAL_SIGNATURE,
233 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
234 0, 0);
235
236 TLS_TEST_REG(goodca1, true,
237 cacert1req.filename, servercert1req.filename, false);
238 TLS_TEST_REG(goodca2, true,
239 cacert2req.filename, servercert2req.filename, false);
240 TLS_TEST_REG(goodca3, true,
241 cacert3req.filename, servercert3req.filename, false);
242
243 /* Now some bad certs */
244
245 /* Key usage:dig-sig:not-critical */
246 TLS_ROOT_REQ(cacert4req,
247 "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
248 true, true, true,
249 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
250 false, false, NULL, NULL,
251 0, 0);
252 TLS_CERT_REQ(servercert4req, cacert4req,
253 "UK", "qemu.org", NULL, NULL, NULL, NULL,
254 true, true, false,
255 true, true,
256 GNUTLS_KEY_DIGITAL_SIGNATURE,
257 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
258 0, 0);
259 /* no-basic */
260 TLS_ROOT_REQ(cacert5req,
261 "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
262 false, false, false,
263 false, false, 0,
264 false, false, NULL, NULL,
265 0, 0);
266 TLS_CERT_REQ(servercert5req, cacert5req,
267 "UK", "qemu.org", NULL, NULL, NULL, NULL,
268 true, true, false,
269 true, true,
270 GNUTLS_KEY_DIGITAL_SIGNATURE,
271 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
272 0, 0);
273 /* Key usage:dig-sig:critical */
274 TLS_ROOT_REQ(cacert6req,
275 "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
276 true, true, true,
277 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
278 false, false, NULL, NULL,
279 0, 0);
280 TLS_CERT_REQ(servercert6req, cacert6req,
281 "UK", "qemu.org", NULL, NULL, NULL, NULL,
282 true, true, false,
283 true, true,
284 GNUTLS_KEY_DIGITAL_SIGNATURE,
285 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
286 0, 0);
287
288 TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
289 true);
290 TLS_TEST_REG(badca2, true,
291 cacert5req.filename, servercert5req.filename, true);
292 TLS_TEST_REG(badca3, true,
293 cacert6req.filename, servercert6req.filename, true);
294
295
296 /* Various good servers */
297 /* no usage or purpose */
298 TLS_CERT_REQ(servercert7req, cacertreq,
299 "UK", "qemu", NULL, NULL, NULL, NULL,
300 true, true, false,
301 false, false, 0,
302 false, false, NULL, NULL,
303 0, 0);
304 /* usage:cert-sign+dig-sig+encipher:critical */
305 TLS_CERT_REQ(servercert8req, cacertreq,
306 "UK", "qemu", NULL, NULL, NULL, NULL,
307 true, true, false,
308 true, true,
309 GNUTLS_KEY_DIGITAL_SIGNATURE |
310 GNUTLS_KEY_KEY_CERT_SIGN,
311 false, false, NULL, NULL,
312 0, 0);
313 /* usage:cert-sign:not-critical */
314 TLS_CERT_REQ(servercert9req, cacertreq,
315 "UK", "qemu", NULL, NULL, NULL, NULL,
316 true, true, false,
317 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
318 false, false, NULL, NULL,
319 0, 0);
320 /* purpose:server:critical */
321 TLS_CERT_REQ(servercert10req, cacertreq,
322 "UK", "qemu", NULL, NULL, NULL, NULL,
323 true, true, false,
324 false, false, 0,
325 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
326 0, 0);
327 /* purpose:server:not-critical */
328 TLS_CERT_REQ(servercert11req, cacertreq,
329 "UK", "qemu", NULL, NULL, NULL, NULL,
330 true, true, false,
331 false, false, 0,
332 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
333 0, 0);
334 /* purpose:client+server:critical */
335 TLS_CERT_REQ(servercert12req, cacertreq,
336 "UK", "qemu", NULL, NULL, NULL, NULL,
337 true, true, false,
338 false, false, 0,
339 true, true,
340 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
341 0, 0);
342 /* purpose:client+server:not-critical */
343 TLS_CERT_REQ(servercert13req, cacertreq,
344 "UK", "qemu", NULL, NULL, NULL, NULL,
345 true, true, false,
346 false, false, 0,
347 true, false,
348 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
349 0, 0);
350
351 TLS_TEST_REG(goodserver1, true,
352 cacertreq.filename, servercert7req.filename, false);
353 TLS_TEST_REG(goodserver2, true,
354 cacertreq.filename, servercert8req.filename, false);
355 TLS_TEST_REG(goodserver3, true,
356 cacertreq.filename, servercert9req.filename, false);
357 TLS_TEST_REG(goodserver4, true,
358 cacertreq.filename, servercert10req.filename, false);
359 TLS_TEST_REG(goodserver5, true,
360 cacertreq.filename, servercert11req.filename, false);
361 TLS_TEST_REG(goodserver6, true,
362 cacertreq.filename, servercert12req.filename, false);
363 TLS_TEST_REG(goodserver7, true,
364 cacertreq.filename, servercert13req.filename, false);
365
366 /* Bad servers */
367
368 /* usage:cert-sign:critical */
369 TLS_CERT_REQ(servercert14req, cacertreq,
370 "UK", "qemu", NULL, NULL, NULL, NULL,
371 true, true, false,
372 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
373 false, false, NULL, NULL,
374 0, 0);
375 /* purpose:client:critical */
376 TLS_CERT_REQ(servercert15req, cacertreq,
377 "UK", "qemu", NULL, NULL, NULL, NULL,
378 true, true, false,
379 false, false, 0,
380 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
381 0, 0);
382 /* usage: none:critical */
383 TLS_CERT_REQ(servercert16req, cacertreq,
384 "UK", "qemu", NULL, NULL, NULL, NULL,
385 true, true, false,
386 true, true, 0,
387 false, false, NULL, NULL,
388 0, 0);
389
390 TLS_TEST_REG(badserver1, true,
391 cacertreq.filename, servercert14req.filename, true);
392 TLS_TEST_REG(badserver2, true,
393 cacertreq.filename, servercert15req.filename, true);
394 TLS_TEST_REG(badserver3, true,
395 cacertreq.filename, servercert16req.filename, true);
396
397
398
399 /* Various good clients */
400 /* no usage or purpose */
401 TLS_CERT_REQ(clientcert1req, cacertreq,
402 "UK", "qemu", NULL, NULL, NULL, NULL,
403 true, true, false,
404 false, false, 0,
405 false, false, NULL, NULL,
406 0, 0);
407 /* usage:cert-sign+dig-sig+encipher:critical */
408 TLS_CERT_REQ(clientcert2req, cacertreq,
409 "UK", "qemu", NULL, NULL, NULL, NULL,
410 true, true, false,
411 true, true,
412 GNUTLS_KEY_DIGITAL_SIGNATURE |
413 GNUTLS_KEY_KEY_CERT_SIGN,
414 false, false, NULL, NULL,
415 0, 0);
416 /* usage:cert-sign:not-critical */
417 TLS_CERT_REQ(clientcert3req, cacertreq,
418 "UK", "qemu", NULL, NULL, NULL, NULL,
419 true, true, false,
420 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
421 false, false, NULL, NULL,
422 0, 0);
423 /* purpose:client:critical */
424 TLS_CERT_REQ(clientcert4req, cacertreq,
425 "UK", "qemu", NULL, NULL, NULL, NULL,
426 true, true, false,
427 false, false, 0,
428 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
429 0, 0);
430 /* purpose:client:not-critical */
431 TLS_CERT_REQ(clientcert5req, cacertreq,
432 "UK", "qemu", NULL, NULL, NULL, NULL,
433 true, true, false,
434 false, false, 0,
435 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
436 0, 0);
437 /* purpose:client+client:critical */
438 TLS_CERT_REQ(clientcert6req, cacertreq,
439 "UK", "qemu", NULL, NULL, NULL, NULL,
440 true, true, false,
441 false, false, 0,
442 true, true,
443 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
444 0, 0);
445 /* purpose:client+client:not-critical */
446 TLS_CERT_REQ(clientcert7req, cacertreq,
447 "UK", "qemu", NULL, NULL, NULL, NULL,
448 true, true, false,
449 false, false, 0,
450 true, false,
451 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
452 0, 0);
453
454 TLS_TEST_REG(goodclient1, false,
455 cacertreq.filename, clientcert1req.filename, false);
456 TLS_TEST_REG(goodclient2, false,
457 cacertreq.filename, clientcert2req.filename, false);
458 TLS_TEST_REG(goodclient3, false,
459 cacertreq.filename, clientcert3req.filename, false);
460 TLS_TEST_REG(goodclient4, false,
461 cacertreq.filename, clientcert4req.filename, false);
462 TLS_TEST_REG(goodclient5, false,
463 cacertreq.filename, clientcert5req.filename, false);
464 TLS_TEST_REG(goodclient6, false,
465 cacertreq.filename, clientcert6req.filename, false);
466 TLS_TEST_REG(goodclient7, false,
467 cacertreq.filename, clientcert7req.filename, false);
468
469 /* Bad clients */
470
471 /* usage:cert-sign:critical */
472 TLS_CERT_REQ(clientcert8req, cacertreq,
473 "UK", "qemu", NULL, NULL, NULL, NULL,
474 true, true, false,
475 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
476 false, false, NULL, NULL,
477 0, 0);
478 /* purpose:client:critical */
479 TLS_CERT_REQ(clientcert9req, cacertreq,
480 "UK", "qemu", NULL, NULL, NULL, NULL,
481 true, true, false,
482 false, false, 0,
483 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
484 0, 0);
485 /* usage: none:critical */
486 TLS_CERT_REQ(clientcert10req, cacertreq,
487 "UK", "qemu", NULL, NULL, NULL, NULL,
488 true, true, false,
489 true, true, 0,
490 false, false, NULL, NULL,
491 0, 0);
492
493 TLS_TEST_REG(badclient1, false,
494 cacertreq.filename, clientcert8req.filename, true);
495 TLS_TEST_REG(badclient2, false,
496 cacertreq.filename, clientcert9req.filename, true);
497 TLS_TEST_REG(badclient3, false,
498 cacertreq.filename, clientcert10req.filename, true);
499
500
501
502 /* Expired stuff */
503
504 TLS_ROOT_REQ(cacertexpreq,
505 "UK", "qemu", NULL, NULL, NULL, NULL,
506 true, true, true,
507 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
508 false, false, NULL, NULL,
509 0, -1);
510 TLS_CERT_REQ(servercertexpreq, cacertexpreq,
511 "UK", "qemu.org", NULL, NULL, NULL, NULL,
512 true, true, false,
513 true, true,
514 GNUTLS_KEY_DIGITAL_SIGNATURE,
515 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
516 0, 0);
517 TLS_CERT_REQ(servercertexp1req, cacertreq,
518 "UK", "qemu", NULL, NULL, NULL, NULL,
519 true, true, false,
520 true, true,
521 GNUTLS_KEY_DIGITAL_SIGNATURE,
522 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
523 0, -1);
524 TLS_CERT_REQ(clientcertexp1req, cacertreq,
525 "UK", "qemu", NULL, NULL, NULL, NULL,
526 true, true, false,
527 true, true,
528 GNUTLS_KEY_DIGITAL_SIGNATURE,
529 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
530 0, -1);
531
532 TLS_TEST_REG(expired1, true,
533 cacertexpreq.filename, servercertexpreq.filename, true);
534 TLS_TEST_REG(expired2, true,
535 cacertreq.filename, servercertexp1req.filename, true);
536 TLS_TEST_REG(expired3, false,
537 cacertreq.filename, clientcertexp1req.filename, true);
538
539
540 /* Not activated stuff */
541
542 TLS_ROOT_REQ(cacertnewreq,
543 "UK", "qemu", NULL, NULL, NULL, NULL,
544 true, true, true,
545 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
546 false, false, NULL, NULL,
547 1, 2);
548 TLS_CERT_REQ(servercertnewreq, cacertnewreq,
549 "UK", "qemu", NULL, NULL, NULL, NULL,
550 true, true, false,
551 true, true,
552 GNUTLS_KEY_DIGITAL_SIGNATURE,
553 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
554 0, 0);
555 TLS_CERT_REQ(servercertnew1req, cacertreq,
556 "UK", "qemu", NULL, NULL, NULL, NULL,
557 true, true, false,
558 true, true,
559 GNUTLS_KEY_DIGITAL_SIGNATURE,
560 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
561 1, 2);
562 TLS_CERT_REQ(clientcertnew1req, cacertreq,
563 "UK", "qemu", NULL, NULL, NULL, NULL,
564 true, true, false,
565 true, true,
566 GNUTLS_KEY_DIGITAL_SIGNATURE,
567 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
568 1, 2);
569
570 TLS_TEST_REG(inactive1, true,
571 cacertnewreq.filename, servercertnewreq.filename, true);
572 TLS_TEST_REG(inactive2, true,
573 cacertreq.filename, servercertnew1req.filename, true);
574 TLS_TEST_REG(inactive3, false,
575 cacertreq.filename, clientcertnew1req.filename, true);
576
577 TLS_ROOT_REQ(cacertrootreq,
578 "UK", "qemu root", NULL, NULL, NULL, NULL,
579 true, true, true,
580 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
581 false, false, NULL, NULL,
582 0, 0);
583 TLS_ROOT_REQ(someotherrootreq,
584 "UK", "some other random CA", NULL, NULL, NULL, NULL,
585 true, true, true,
586 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
587 false, false, NULL, NULL,
588 0, 0);
589 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
590 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
591 true, true, true,
592 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
593 false, false, NULL, NULL,
594 0, 0);
595 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
596 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
597 true, true, true,
598 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
599 false, false, NULL, NULL,
600 0, 0);
601 TLS_CERT_REQ(cacertlevel1creq_invalid, cacertrootreq,
602 "UK", "qemu level 1c invalid", NULL, NULL, NULL, NULL,
603 true, true, true,
604 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
605 false, false, NULL, NULL,
606 360, 400);
607 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
608 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
609 true, true, true,
610 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
611 false, false, NULL, NULL,
612 0, 0);
613 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
614 "UK", "qemu.org", NULL, NULL, NULL, NULL,
615 true, true, false,
616 true, true,
617 GNUTLS_KEY_DIGITAL_SIGNATURE,
618 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
619 0, 0);
620 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
621 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
622 true, true, false,
623 true, true,
624 GNUTLS_KEY_DIGITAL_SIGNATURE,
625 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
626 0, 0);
627
628 gnutls_x509_crt_t certchain[] = {
629 cacertrootreq.crt,
630 cacertlevel1areq.crt,
631 cacertlevel1breq.crt,
632 cacertlevel2areq.crt,
633 };
634
635 gnutls_x509_crt_t cabundle[] = {
636 someotherrootreq.crt,
637 cacertrootreq.crt,
638 };
639
640 gnutls_x509_crt_t servercertchain[] = {
641 servercertlevel3areq.crt,
642 cacertlevel2areq.crt,
643 cacertlevel1areq.crt,
644 };
645
646 gnutls_x509_crt_t servercertchain_incomplete[] = {
647 servercertlevel3areq.crt,
648 cacertlevel2areq.crt,
649 };
650
651 gnutls_x509_crt_t servercertchain_unsorted[] = {
652 servercertlevel3areq.crt,
653 cacertlevel1areq.crt,
654 cacertlevel2areq.crt,
655 };
656
657 gnutls_x509_crt_t clientcertchain[] = {
658 clientcertlevel2breq.crt,
659 cacertlevel1breq.crt,
660 };
661
662 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
663 certchain,
664 G_N_ELEMENTS(certchain));
665
666 gnutls_x509_crt_t certchain_with_invalid[] = {
667 cacertrootreq.crt,
668 cacertlevel1areq.crt,
669 cacertlevel1breq.crt,
670 cacertlevel1creq_invalid.crt,
671 cacertlevel2areq.crt,
672 };
673
674 test_tls_write_cert_chain(WORKDIR "cacertchain-with-invalid-ctx.pem",
675 certchain_with_invalid,
676 G_N_ELEMENTS(certchain_with_invalid));
677
678 gnutls_x509_crt_t certchain_incomplete[] = {
679 cacertrootreq.crt,
680 cacertlevel2areq.crt,
681 };
682
683 test_tls_write_cert_chain(WORKDIR "cacertchain-incomplete-ctx.pem",
684 certchain_incomplete,
685 G_N_ELEMENTS(certchain_incomplete));
686
687 TLS_TEST_REG(chain1, true,
688 WORKDIR "cacertchain-ctx.pem",
689 servercertlevel3areq.filename, false);
690 TLS_TEST_REG(chain2, false,
691 WORKDIR "cacertchain-ctx.pem",
692 clientcertlevel2breq.filename, false);
693 TLS_TEST_REG(certchainwithexpiredcert, false,
694 WORKDIR "cacertchain-with-invalid-ctx.pem",
695 clientcertlevel2breq.filename, false);
696 TLS_TEST_REG(chainincomplete, true,
697 WORKDIR "cacertchain-incomplete-ctx.pem",
698 servercertlevel3areq.filename, true);
699
700 test_tls_write_cert_chain(WORKDIR "servercertchain-ctx.pem",
701 servercertchain,
702 G_N_ELEMENTS(servercertchain));
703
704 TLS_TEST_REG(serverchain, true,
705 cacertrootreq.filename,
706 WORKDIR "servercertchain-ctx.pem", false);
707
708 test_tls_write_cert_chain(WORKDIR "cabundle-ctx.pem",
709 cabundle,
710 G_N_ELEMENTS(cabundle));
711
712 TLS_TEST_REG(multiplecaswithchain, true,
713 WORKDIR "cabundle-ctx.pem",
714 WORKDIR "servercertchain-ctx.pem", false);
715
716 test_tls_write_cert_chain(WORKDIR "servercertchain_incomplete-ctx.pem",
717 servercertchain_incomplete,
718 G_N_ELEMENTS(servercertchain_incomplete));
719
720 TLS_TEST_REG(incompleteserverchain, true,
721 cacertrootreq.filename,
722 WORKDIR "servercertchain_incomplete-ctx.pem", true);
723
724 test_tls_write_cert_chain(WORKDIR "servercertchain_unsorted-ctx.pem",
725 servercertchain_unsorted,
726 G_N_ELEMENTS(servercertchain_unsorted));
727
728 TLS_TEST_REG(unsortedserverchain, true,
729 cacertrootreq.filename,
730 WORKDIR "servercertchain_unsorted-ctx.pem", true);
731
732 test_tls_write_cert_chain(WORKDIR "clientcertchain-ctx.pem",
733 clientcertchain,
734 G_N_ELEMENTS(clientcertchain));
735
736 TLS_TEST_REG(clientchain, false,
737 cacertrootreq.filename,
738 WORKDIR "clientcertchain-ctx.pem", false);
739
740 /* Some missing certs - first two are fatal, the last
741 * is ok
742 */
743 TLS_TEST_REG(missingca, true,
744 "cacertdoesnotexist.pem",
745 servercert1req.filename, true);
746 TLS_TEST_REG(missingserver, true,
747 cacert1req.filename,
748 "servercertdoesnotexist.pem", true);
749 TLS_TEST_REG(missingclient, false,
750 cacert1req.filename,
751 "clientcertdoesnotexist.pem", false);
752 ret = g_test_run();
753
754 test_tls_discard_cert(&cacertreq);
755 test_tls_discard_cert(&cacert1req);
756 test_tls_discard_cert(&cacert2req);
757 test_tls_discard_cert(&cacert3req);
758 test_tls_discard_cert(&cacert4req);
759 test_tls_discard_cert(&cacert5req);
760 test_tls_discard_cert(&cacert6req);
761
762 test_tls_discard_cert(&servercertreq);
763 test_tls_discard_cert(&servercert1req);
764 test_tls_discard_cert(&servercert2req);
765 test_tls_discard_cert(&servercert3req);
766 test_tls_discard_cert(&servercert4req);
767 test_tls_discard_cert(&servercert5req);
768 test_tls_discard_cert(&servercert6req);
769 test_tls_discard_cert(&servercert7req);
770 test_tls_discard_cert(&servercert8req);
771 test_tls_discard_cert(&servercert9req);
772 test_tls_discard_cert(&servercert10req);
773 test_tls_discard_cert(&servercert11req);
774 test_tls_discard_cert(&servercert12req);
775 test_tls_discard_cert(&servercert13req);
776 test_tls_discard_cert(&servercert14req);
777 test_tls_discard_cert(&servercert15req);
778 test_tls_discard_cert(&servercert16req);
779
780 test_tls_discard_cert(&clientcertreq);
781 test_tls_discard_cert(&clientcert1req);
782 test_tls_discard_cert(&clientcert2req);
783 test_tls_discard_cert(&clientcert3req);
784 test_tls_discard_cert(&clientcert4req);
785 test_tls_discard_cert(&clientcert5req);
786 test_tls_discard_cert(&clientcert6req);
787 test_tls_discard_cert(&clientcert7req);
788 test_tls_discard_cert(&clientcert8req);
789 test_tls_discard_cert(&clientcert9req);
790 test_tls_discard_cert(&clientcert10req);
791
792 test_tls_discard_cert(&cacertexpreq);
793 test_tls_discard_cert(&servercertexpreq);
794 test_tls_discard_cert(&servercertexp1req);
795 test_tls_discard_cert(&clientcertexp1req);
796
797 test_tls_discard_cert(&cacertnewreq);
798 test_tls_discard_cert(&servercertnewreq);
799 test_tls_discard_cert(&servercertnew1req);
800 test_tls_discard_cert(&clientcertnew1req);
801
802 test_tls_discard_cert(&cacertrootreq);
803 test_tls_discard_cert(&cacertlevel1areq);
804 test_tls_discard_cert(&cacertlevel1breq);
805 test_tls_discard_cert(&cacertlevel1creq_invalid);
806 test_tls_discard_cert(&cacertlevel2areq);
807 test_tls_discard_cert(&servercertlevel3areq);
808 test_tls_discard_cert(&clientcertlevel2breq);
809 test_tls_discard_cert(&someotherrootreq);
810 unlink(WORKDIR "cacertchain-ctx.pem");
811 unlink(WORKDIR "cacertchain-with-invalid-ctx.pem");
812 unlink(WORKDIR "servercertchain-ctx.pem");
813 unlink(WORKDIR "servercertchain_incomplete-ctx.pem");
814 unlink(WORKDIR "servercertchain_unsorted-ctx.pem");
815 unlink(WORKDIR "clientcertchain-ctx.pem");
816
817 test_tls_cleanup(KEYFILE);
818 rmdir(WORKDIR);
819
820 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
821 }