]> Git Repo - qemu.git/blame - tests/test-crypto-tlscredsx509.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: Force Python I/O encoding for check-qapi-schema
[qemu.git] / tests / test-crypto-tlscredsx509.c
CommitLineData
9a2fd434
DB		 1/*
2 * Copyright (C) 2015 Red Hat, Inc.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library. If not, see
16 * <http://www.gnu.org/licenses/>.
17 *
18 * Author: Daniel P. Berrange <[email protected]>
19 */
20
681c28a3 21#include "qemu/osdep.h"
9a2fd434 22
9a2fd434
DB		 23#include "crypto-tls-x509-helpers.h"
24#include "crypto/tlscredsx509.h"
da34e65c 25#include "qapi/error.h"
9a2fd434
DB		 26
27#ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
28
29#define WORKDIR "tests/test-crypto-tlscredsx509-work/"
30#define KEYFILE WORKDIR "key-ctx.pem"
31
32struct QCryptoTLSCredsTestData {
33 bool isServer;
34 const char *cacrt;
35 const char *crt;
36 bool expectFail;
37};
38
39
40static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
41 const char *certdir,
42 Error **errp)
43{
44 Object *parent = object_get_objects_root();
45 Object *creds = object_new_with_props(
46 TYPE_QCRYPTO_TLS_CREDS_X509,
47 parent,
48 "testtlscreds",
49 errp,
50 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
51 "server" : "client"),
52 "dir", certdir,
53 "verify-peer", "yes",
54 "sanity-check", "yes",
55 NULL);
56
68db1318 57 if (!creds) {
9a2fd434
DB		 58 return NULL;
59 }
60 return QCRYPTO_TLS_CREDS(creds);
61}
62
63/*
64 * This tests sanity checking of our own certificates
65 *
66 * The code being tested is used when TLS creds are created,
67 * and aim to ensure QMEU has been configured with sane
68 * certificates. This allows us to give much much much
69 * clearer error messages to the admin when they misconfigure
70 * things.
71 */
72static void test_tls_creds(const void *opaque)
73{
74 struct QCryptoTLSCredsTestData *data =
75 (struct QCryptoTLSCredsTestData *)opaque;
76 QCryptoTLSCreds *creds;
9a2fd434
DB		 77
78#define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
79 mkdir(CERT_DIR, 0700);
80
81 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
82 if (data->isServer) {
83 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
84 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
85 } else {
86 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
87 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
88 }
89
90 if (access(data->cacrt, R_OK) == 0) {
91 g_assert(link(data->cacrt,
92 CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
93 }
94 if (data->isServer) {
95 if (access(data->crt, R_OK) == 0) {
96 g_assert(link(data->crt,
97 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
98 }
99 g_assert(link(KEYFILE,
100 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
101 } else {
102 if (access(data->crt, R_OK) == 0) {
103 g_assert(link(data->crt,
104 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
105 }
106 g_assert(link(KEYFILE,
107 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
108 }
109
110 creds = test_tls_creds_create(
111 (data->isServer ?
112 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
113 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
114 CERT_DIR,
68db1318 115 data->expectFail ? NULL : &error_abort);
9a2fd434
DB		 116
117 if (data->expectFail) {
9a2fd434
DB		 118 g_assert(creds == NULL);
119 } else {
9a2fd434
DB		 120 g_assert(creds != NULL);
121 }
122
123 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
124 if (data->isServer) {
125 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
126 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
127 } else {
128 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
129 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
130 }
131 rmdir(CERT_DIR);
132 if (creds) {
133 object_unparent(OBJECT(creds));
134 }
135}
136
137int main(int argc, char **argv)
138{
139 int ret;
140
141 module_call_init(MODULE_INIT_QOM);
142 g_test_init(&argc, &argv, NULL);
143 setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
144
145 mkdir(WORKDIR, 0700);
146
147 test_tls_init(KEYFILE);
148
149# define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \
150 struct QCryptoTLSCredsTestData name = { \
151 isServer, caCrt, crt, expectFail \
152 }; \
153 g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \
154 &name, test_tls_creds); \
155
156 /* A perfect CA, perfect client & perfect server */
157
158 /* Basic:CA:critical */
159 TLS_ROOT_REQ(cacertreq,
160 "UK", "qemu CA", NULL, NULL, NULL, NULL,
161 true, true, true,
162 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
163 false, false, NULL, NULL,
164 0, 0);
165
166 TLS_CERT_REQ(servercertreq, cacertreq,
167 "UK", "qemu.org", NULL, NULL, NULL, NULL,
168 true, true, false,
169 true, true,
170 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
171 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
172 0, 0);
173 TLS_CERT_REQ(clientcertreq, cacertreq,
174 "UK", "qemu", NULL, NULL, NULL, NULL,
175 true, true, false,
176 true, true,
177 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
178 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
179 0, 0);
180
181 TLS_TEST_REG(perfectserver, true,
182 cacertreq.filename, servercertreq.filename, false);
183 TLS_TEST_REG(perfectclient, false,
184 cacertreq.filename, clientcertreq.filename, false);
185
186
187 /* Some other CAs which are good */
188
189 /* Basic:CA:critical */
190 TLS_ROOT_REQ(cacert1req,
191 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
192 true, true, true,
193 false, false, 0,
194 false, false, NULL, NULL,
195 0, 0);
196 TLS_CERT_REQ(servercert1req, cacert1req,
197 "UK", "qemu.org", NULL, NULL, NULL, NULL,
198 true, true, false,
199 true, true,
200 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
201 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
202 0, 0);
203
204 /* Basic:CA:not-critical */
205 TLS_ROOT_REQ(cacert2req,
206 "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
207 true, false, true,
208 false, false, 0,
209 false, false, NULL, NULL,
210 0, 0);
211 TLS_CERT_REQ(servercert2req, cacert2req,
212 "UK", "qemu.org", NULL, NULL, NULL, NULL,
213 true, true, false,
214 true, true,
215 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
216 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
217 0, 0);
218
219 /* Key usage:cert-sign:critical */
220 TLS_ROOT_REQ(cacert3req,
221 "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
222 true, true, true,
223 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
224 false, false, NULL, NULL,
225 0, 0);
226 TLS_CERT_REQ(servercert3req, cacert3req,
227 "UK", "qemu.org", NULL, NULL, NULL, NULL,
228 true, true, false,
229 true, true,
230 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
231 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
232 0, 0);
233
234 TLS_TEST_REG(goodca1, true,
235 cacert1req.filename, servercert1req.filename, false);
236 TLS_TEST_REG(goodca2, true,
237 cacert2req.filename, servercert2req.filename, false);
238 TLS_TEST_REG(goodca3, true,
239 cacert3req.filename, servercert3req.filename, false);
240
241 /* Now some bad certs */
242
243 /* Key usage:dig-sig:not-critical */
244 TLS_ROOT_REQ(cacert4req,
245 "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
246 true, true, true,
247 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
248 false, false, NULL, NULL,
249 0, 0);
250 TLS_CERT_REQ(servercert4req, cacert4req,
251 "UK", "qemu.org", NULL, NULL, NULL, NULL,
252 true, true, false,
253 true, true,
254 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
255 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
256 0, 0);
257 /* no-basic */
258 TLS_ROOT_REQ(cacert5req,
259 "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
260 false, false, false,
261 false, false, 0,
262 false, false, NULL, NULL,
263 0, 0);
264 TLS_CERT_REQ(servercert5req, cacert5req,
265 "UK", "qemu.org", NULL, NULL, NULL, NULL,
266 true, true, false,
267 true, true,
268 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
269 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
270 0, 0);
271 /* Key usage:dig-sig:critical */
272 TLS_ROOT_REQ(cacert6req,
273 "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
274 true, true, true,
275 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
276 false, false, NULL, NULL,
277 0, 0);
278 TLS_CERT_REQ(servercert6req, cacert6req,
279 "UK", "qemu.org", NULL, NULL, NULL, NULL,
280 true, true, false,
281 true, true,
282 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
283 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
284 0, 0);
285
9a2fd434 286 TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
a0722409 287 true);
9a2fd434
DB		 288 TLS_TEST_REG(badca2, true,
289 cacert5req.filename, servercert5req.filename, true);
290 TLS_TEST_REG(badca3, true,
291 cacert6req.filename, servercert6req.filename, true);
292
293
294 /* Various good servers */
295 /* no usage or purpose */
296 TLS_CERT_REQ(servercert7req, cacertreq,
297 "UK", "qemu", NULL, NULL, NULL, NULL,
298 true, true, false,
299 false, false, 0,
300 false, false, NULL, NULL,
301 0, 0);
302 /* usage:cert-sign+dig-sig+encipher:critical */
303 TLS_CERT_REQ(servercert8req, cacertreq,
304 "UK", "qemu", NULL, NULL, NULL, NULL,
305 true, true, false,
306 true, true,
307 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
308 GNUTLS_KEY_KEY_CERT_SIGN,
309 false, false, NULL, NULL,
310 0, 0);
311 /* usage:cert-sign:not-critical */
312 TLS_CERT_REQ(servercert9req, cacertreq,
313 "UK", "qemu", NULL, NULL, NULL, NULL,
314 true, true, false,
315 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
316 false, false, NULL, NULL,
317 0, 0);
318 /* purpose:server:critical */
319 TLS_CERT_REQ(servercert10req, cacertreq,
320 "UK", "qemu", NULL, NULL, NULL, NULL,
321 true, true, false,
322 false, false, 0,
323 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
324 0, 0);
325 /* purpose:server:not-critical */
326 TLS_CERT_REQ(servercert11req, cacertreq,
327 "UK", "qemu", NULL, NULL, NULL, NULL,
328 true, true, false,
329 false, false, 0,
330 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
331 0, 0);
332 /* purpose:client+server:critical */
333 TLS_CERT_REQ(servercert12req, cacertreq,
334 "UK", "qemu", NULL, NULL, NULL, NULL,
335 true, true, false,
336 false, false, 0,
337 true, true,
338 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
339 0, 0);
340 /* purpose:client+server:not-critical */
341 TLS_CERT_REQ(servercert13req, cacertreq,
342 "UK", "qemu", NULL, NULL, NULL, NULL,
343 true, true, false,
344 false, false, 0,
345 true, false,
346 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
347 0, 0);
348
349 TLS_TEST_REG(goodserver1, true,
350 cacertreq.filename, servercert7req.filename, false);
351 TLS_TEST_REG(goodserver2, true,
352 cacertreq.filename, servercert8req.filename, false);
353 TLS_TEST_REG(goodserver3, true,
354 cacertreq.filename, servercert9req.filename, false);
355 TLS_TEST_REG(goodserver4, true,
356 cacertreq.filename, servercert10req.filename, false);
357 TLS_TEST_REG(goodserver5, true,
358 cacertreq.filename, servercert11req.filename, false);
359 TLS_TEST_REG(goodserver6, true,
360 cacertreq.filename, servercert12req.filename, false);
361 TLS_TEST_REG(goodserver7, true,
362 cacertreq.filename, servercert13req.filename, false);
363
364 /* Bad servers */
365
366 /* usage:cert-sign:critical */
367 TLS_CERT_REQ(servercert14req, cacertreq,
368 "UK", "qemu", NULL, NULL, NULL, NULL,
369 true, true, false,
370 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
371 false, false, NULL, NULL,
372 0, 0);
373 /* purpose:client:critical */
374 TLS_CERT_REQ(servercert15req, cacertreq,
375 "UK", "qemu", NULL, NULL, NULL, NULL,
376 true, true, false,
377 false, false, 0,
378 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
379 0, 0);
380 /* usage: none:critical */
381 TLS_CERT_REQ(servercert16req, cacertreq,
382 "UK", "qemu", NULL, NULL, NULL, NULL,
383 true, true, false,
384 true, true, 0,
385 false, false, NULL, NULL,
386 0, 0);
387
388 TLS_TEST_REG(badserver1, true,
389 cacertreq.filename, servercert14req.filename, true);
390 TLS_TEST_REG(badserver2, true,
391 cacertreq.filename, servercert15req.filename, true);
392 TLS_TEST_REG(badserver3, true,
393 cacertreq.filename, servercert16req.filename, true);
394
395
396
397 /* Various good clients */
398 /* no usage or purpose */
399 TLS_CERT_REQ(clientcert1req, cacertreq,
400 "UK", "qemu", NULL, NULL, NULL, NULL,
401 true, true, false,
402 false, false, 0,
403 false, false, NULL, NULL,
404 0, 0);
405 /* usage:cert-sign+dig-sig+encipher:critical */
406 TLS_CERT_REQ(clientcert2req, cacertreq,
407 "UK", "qemu", NULL, NULL, NULL, NULL,
408 true, true, false,
409 true, true,
410 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
411 GNUTLS_KEY_KEY_CERT_SIGN,
412 false, false, NULL, NULL,
413 0, 0);
414 /* usage:cert-sign:not-critical */
415 TLS_CERT_REQ(clientcert3req, cacertreq,
416 "UK", "qemu", NULL, NULL, NULL, NULL,
417 true, true, false,
418 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
419 false, false, NULL, NULL,
420 0, 0);
421 /* purpose:client:critical */
422 TLS_CERT_REQ(clientcert4req, cacertreq,
423 "UK", "qemu", NULL, NULL, NULL, NULL,
424 true, true, false,
425 false, false, 0,
426 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
427 0, 0);
428 /* purpose:client:not-critical */
429 TLS_CERT_REQ(clientcert5req, cacertreq,
430 "UK", "qemu", NULL, NULL, NULL, NULL,
431 true, true, false,
432 false, false, 0,
433 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
434 0, 0);
435 /* purpose:client+client:critical */
436 TLS_CERT_REQ(clientcert6req, cacertreq,
437 "UK", "qemu", NULL, NULL, NULL, NULL,
438 true, true, false,
439 false, false, 0,
440 true, true,
441 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
442 0, 0);
443 /* purpose:client+client:not-critical */
444 TLS_CERT_REQ(clientcert7req, cacertreq,
445 "UK", "qemu", NULL, NULL, NULL, NULL,
446 true, true, false,
447 false, false, 0,
448 true, false,
449 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
450 0, 0);
451
452 TLS_TEST_REG(goodclient1, false,
453 cacertreq.filename, clientcert1req.filename, false);
454 TLS_TEST_REG(goodclient2, false,
455 cacertreq.filename, clientcert2req.filename, false);
456 TLS_TEST_REG(goodclient3, false,
457 cacertreq.filename, clientcert3req.filename, false);
458 TLS_TEST_REG(goodclient4, false,
459 cacertreq.filename, clientcert4req.filename, false);
460 TLS_TEST_REG(goodclient5, false,
461 cacertreq.filename, clientcert5req.filename, false);
462 TLS_TEST_REG(goodclient6, false,
463 cacertreq.filename, clientcert6req.filename, false);
464 TLS_TEST_REG(goodclient7, false,
465 cacertreq.filename, clientcert7req.filename, false);
466
467 /* Bad clients */
468
469 /* usage:cert-sign:critical */
470 TLS_CERT_REQ(clientcert8req, cacertreq,
471 "UK", "qemu", NULL, NULL, NULL, NULL,
472 true, true, false,
473 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
474 false, false, NULL, NULL,
475 0, 0);
476 /* purpose:client:critical */
477 TLS_CERT_REQ(clientcert9req, cacertreq,
478 "UK", "qemu", NULL, NULL, NULL, NULL,
479 true, true, false,
480 false, false, 0,
481 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
482 0, 0);
483 /* usage: none:critical */
484 TLS_CERT_REQ(clientcert10req, cacertreq,
485 "UK", "qemu", NULL, NULL, NULL, NULL,
486 true, true, false,
487 true, true, 0,
488 false, false, NULL, NULL,
489 0, 0);
490
491 TLS_TEST_REG(badclient1, false,
492 cacertreq.filename, clientcert8req.filename, true);
493 TLS_TEST_REG(badclient2, false,
494 cacertreq.filename, clientcert9req.filename, true);
495 TLS_TEST_REG(badclient3, false,
496 cacertreq.filename, clientcert10req.filename, true);
497
498
499
500 /* Expired stuff */
501
502 TLS_ROOT_REQ(cacertexpreq,
503 "UK", "qemu", NULL, NULL, NULL, NULL,
504 true, true, true,
505 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
506 false, false, NULL, NULL,
507 0, -1);
508 TLS_CERT_REQ(servercertexpreq, cacertexpreq,
509 "UK", "qemu.org", NULL, NULL, NULL, NULL,
510 true, true, false,
511 true, true,
512 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
513 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
514 0, 0);
515 TLS_CERT_REQ(servercertexp1req, cacertreq,
516 "UK", "qemu", NULL, NULL, NULL, NULL,
517 true, true, false,
518 true, true,
519 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
520 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
521 0, -1);
522 TLS_CERT_REQ(clientcertexp1req, cacertreq,
523 "UK", "qemu", NULL, NULL, NULL, NULL,
524 true, true, false,
525 true, true,
526 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
527 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
528 0, -1);
529
530 TLS_TEST_REG(expired1, true,
531 cacertexpreq.filename, servercertexpreq.filename, true);
532 TLS_TEST_REG(expired2, true,
533 cacertreq.filename, servercertexp1req.filename, true);
534 TLS_TEST_REG(expired3, false,
535 cacertreq.filename, clientcertexp1req.filename, true);
536
537
538 /* Not activated stuff */
539
540 TLS_ROOT_REQ(cacertnewreq,
541 "UK", "qemu", NULL, NULL, NULL, NULL,
542 true, true, true,
543 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
544 false, false, NULL, NULL,
545 1, 2);
546 TLS_CERT_REQ(servercertnewreq, cacertnewreq,
547 "UK", "qemu", NULL, NULL, NULL, NULL,
548 true, true, false,
549 true, true,
550 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
551 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
552 0, 0);
553 TLS_CERT_REQ(servercertnew1req, cacertreq,
554 "UK", "qemu", NULL, NULL, NULL, NULL,
555 true, true, false,
556 true, true,
557 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
558 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
559 1, 2);
560 TLS_CERT_REQ(clientcertnew1req, cacertreq,
561 "UK", "qemu", NULL, NULL, NULL, NULL,
562 true, true, false,
563 true, true,
564 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
565 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
566 1, 2);
567
568 TLS_TEST_REG(inactive1, true,
569 cacertnewreq.filename, servercertnewreq.filename, true);
570 TLS_TEST_REG(inactive2, true,
571 cacertreq.filename, servercertnew1req.filename, true);
572 TLS_TEST_REG(inactive3, false,
573 cacertreq.filename, clientcertnew1req.filename, true);
574
575 TLS_ROOT_REQ(cacertrootreq,
576 "UK", "qemu root", NULL, NULL, NULL, NULL,
577 true, true, true,
578 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
579 false, false, NULL, NULL,
580 0, 0);
581 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
582 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
583 true, true, true,
584 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
585 false, false, NULL, NULL,
586 0, 0);
587 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
588 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
589 true, true, true,
590 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
591 false, false, NULL, NULL,
592 0, 0);
593 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
594 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
595 true, true, true,
596 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
597 false, false, NULL, NULL,
598 0, 0);
599 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
600 "UK", "qemu.org", NULL, NULL, NULL, NULL,
601 true, true, false,
602 true, true,
603 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
604 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
605 0, 0);
606 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
607 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
608 true, true, false,
609 true, true,
610 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
611 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
612 0, 0);
613
614 gnutls_x509_crt_t certchain[] = {
615 cacertrootreq.crt,
616 cacertlevel1areq.crt,
617 cacertlevel1breq.crt,
618 cacertlevel2areq.crt,
619 };
620
621 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
622 certchain,
623 G_N_ELEMENTS(certchain));
624
625 TLS_TEST_REG(chain1, true,
626 WORKDIR "cacertchain-ctx.pem",
627 servercertlevel3areq.filename, false);
628 TLS_TEST_REG(chain2, false,
629 WORKDIR "cacertchain-ctx.pem",
630 clientcertlevel2breq.filename, false);
631
632 /* Some missing certs - first two are fatal, the last
633 * is ok
634 */
635 TLS_TEST_REG(missingca, true,
636 "cacertdoesnotexist.pem",
637 servercert1req.filename, true);
638 TLS_TEST_REG(missingserver, true,
639 cacert1req.filename,
640 "servercertdoesnotexist.pem", true);
641 TLS_TEST_REG(missingclient, false,
642 cacert1req.filename,
643 "clientcertdoesnotexist.pem", false);
644
645 ret = g_test_run();
646
647 test_tls_discard_cert(&cacertreq);
648 test_tls_discard_cert(&cacert1req);
649 test_tls_discard_cert(&cacert2req);
650 test_tls_discard_cert(&cacert3req);
651 test_tls_discard_cert(&cacert4req);
652 test_tls_discard_cert(&cacert5req);
653 test_tls_discard_cert(&cacert6req);
654
655 test_tls_discard_cert(&servercertreq);
656 test_tls_discard_cert(&servercert1req);
657 test_tls_discard_cert(&servercert2req);
658 test_tls_discard_cert(&servercert3req);
659 test_tls_discard_cert(&servercert4req);
660 test_tls_discard_cert(&servercert5req);
661 test_tls_discard_cert(&servercert6req);
662 test_tls_discard_cert(&servercert7req);
663 test_tls_discard_cert(&servercert8req);
664 test_tls_discard_cert(&servercert9req);
665 test_tls_discard_cert(&servercert10req);
666 test_tls_discard_cert(&servercert11req);
667 test_tls_discard_cert(&servercert12req);
668 test_tls_discard_cert(&servercert13req);
669 test_tls_discard_cert(&servercert14req);
670 test_tls_discard_cert(&servercert15req);
671 test_tls_discard_cert(&servercert16req);
672
673 test_tls_discard_cert(&clientcertreq);
674 test_tls_discard_cert(&clientcert1req);
675 test_tls_discard_cert(&clientcert2req);
676 test_tls_discard_cert(&clientcert3req);
677 test_tls_discard_cert(&clientcert4req);
678 test_tls_discard_cert(&clientcert5req);
679 test_tls_discard_cert(&clientcert6req);
680 test_tls_discard_cert(&clientcert7req);
681 test_tls_discard_cert(&clientcert8req);
682 test_tls_discard_cert(&clientcert9req);
683 test_tls_discard_cert(&clientcert10req);
684
685 test_tls_discard_cert(&cacertexpreq);
686 test_tls_discard_cert(&servercertexpreq);
687 test_tls_discard_cert(&servercertexp1req);
688 test_tls_discard_cert(&clientcertexp1req);
689
690 test_tls_discard_cert(&cacertnewreq);
691 test_tls_discard_cert(&servercertnewreq);
692 test_tls_discard_cert(&servercertnew1req);
693 test_tls_discard_cert(&clientcertnew1req);
694
695 test_tls_discard_cert(&cacertrootreq);
696 test_tls_discard_cert(&cacertlevel1areq);
697 test_tls_discard_cert(&cacertlevel1breq);
698 test_tls_discard_cert(&cacertlevel2areq);
699 test_tls_discard_cert(&servercertlevel3areq);
700 test_tls_discard_cert(&clientcertlevel2breq);
701 unlink(WORKDIR "cacertchain-ctx.pem");
702
703 test_tls_cleanup(KEYFILE);
704 rmdir(WORKDIR);
705
706 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
707}
708
709#else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
710
711int
712main(void)
713{
714 return EXIT_SUCCESS;
715}
716
717#endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
Empty description
This page took 0.309823 seconds and 4 git commands to generate.