]> git.proxmox.com Git - mirror_qemu.git/blame - tests/unit/test-crypto-tlscredsx509.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
bsd-user: Implement getrlimit(2) and setrlimit(2)
[mirror_qemu.git] / tests / unit / test-crypto-tlscredsx509.c
CommitLineData
9a2fd434
DB		 1/*
2 * Copyright (C) 2015 Red Hat, Inc.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library. If not, see
16 * <http://www.gnu.org/licenses/>.
17 *
18 * Author: Daniel P. Berrange <berrange@redhat.com>
19 */
20
681c28a3 21#include "qemu/osdep.h"
9a2fd434 22
9a2fd434
DB		 23#include "crypto-tls-x509-helpers.h"
24#include "crypto/tlscredsx509.h"
da34e65c 25#include "qapi/error.h"
0b8fa32f 26#include "qemu/module.h"
9a2fd434 27
9a2fd434
DB		 28#define WORKDIR "tests/test-crypto-tlscredsx509-work/"
29#define KEYFILE WORKDIR "key-ctx.pem"
30
31struct QCryptoTLSCredsTestData {
32 bool isServer;
33 const char *cacrt;
34 const char *crt;
35 bool expectFail;
36};
37
38
39static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
40 const char *certdir,
41 Error **errp)
42{
43 Object *parent = object_get_objects_root();
44 Object *creds = object_new_with_props(
45 TYPE_QCRYPTO_TLS_CREDS_X509,
46 parent,
47 "testtlscreds",
48 errp,
49 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
50 "server" : "client"),
51 "dir", certdir,
52 "verify-peer", "yes",
53 "sanity-check", "yes",
54 NULL);
55
68db1318 56 if (!creds) {
9a2fd434
DB		 57 return NULL;
58 }
59 return QCRYPTO_TLS_CREDS(creds);
60}
61
62/*
63 * This tests sanity checking of our own certificates
64 *
65 * The code being tested is used when TLS creds are created,
66 * and aim to ensure QMEU has been configured with sane
67 * certificates. This allows us to give much much much
68 * clearer error messages to the admin when they misconfigure
69 * things.
70 */
71static void test_tls_creds(const void *opaque)
72{
73 struct QCryptoTLSCredsTestData *data =
74 (struct QCryptoTLSCredsTestData *)opaque;
75 QCryptoTLSCreds *creds;
9a2fd434
DB		 76
77#define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
413bebc0 78 g_mkdir_with_parents(CERT_DIR, 0700);
9a2fd434
DB		 79
80 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
81 if (data->isServer) {
82 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
83 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
84 } else {
85 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
86 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
87 }
88
89 if (access(data->cacrt, R_OK) == 0) {
90 g_assert(link(data->cacrt,
91 CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
92 }
93 if (data->isServer) {
94 if (access(data->crt, R_OK) == 0) {
95 g_assert(link(data->crt,
96 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
97 }
98 g_assert(link(KEYFILE,
99 CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
100 } else {
101 if (access(data->crt, R_OK) == 0) {
102 g_assert(link(data->crt,
103 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
104 }
105 g_assert(link(KEYFILE,
106 CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
107 }
108
109 creds = test_tls_creds_create(
110 (data->isServer ?
111 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
112 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
113 CERT_DIR,
68db1318 114 data->expectFail ? NULL : &error_abort);
9a2fd434
DB		 115
116 if (data->expectFail) {
9a2fd434
DB		 117 g_assert(creds == NULL);
118 } else {
9a2fd434
DB		 119 g_assert(creds != NULL);
120 }
121
122 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
123 if (data->isServer) {
124 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
125 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
126 } else {
127 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
128 unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
129 }
130 rmdir(CERT_DIR);
131 if (creds) {
132 object_unparent(OBJECT(creds));
133 }
134}
135
136int main(int argc, char **argv)
137{
138 int ret;
139
140 module_call_init(MODULE_INIT_QOM);
141 g_test_init(&argc, &argv, NULL);
e468ffdc 142 g_setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
9a2fd434 143
413bebc0 144 g_mkdir_with_parents(WORKDIR, 0700);
9a2fd434
DB		 145
146 test_tls_init(KEYFILE);
147
148# define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \
149 struct QCryptoTLSCredsTestData name = { \
150 isServer, caCrt, crt, expectFail \
151 }; \
152 g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \
153 &name, test_tls_creds); \
154
155 /* A perfect CA, perfect client & perfect server */
156
157 /* Basic:CA:critical */
158 TLS_ROOT_REQ(cacertreq,
159 "UK", "qemu CA", NULL, NULL, NULL, NULL,
160 true, true, true,
161 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
162 false, false, NULL, NULL,
163 0, 0);
164
165 TLS_CERT_REQ(servercertreq, cacertreq,
166 "UK", "qemu.org", NULL, NULL, NULL, NULL,
167 true, true, false,
168 true, true,
169 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
170 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
171 0, 0);
172 TLS_CERT_REQ(clientcertreq, cacertreq,
173 "UK", "qemu", NULL, NULL, NULL, NULL,
174 true, true, false,
175 true, true,
176 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
177 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
178 0, 0);
179
180 TLS_TEST_REG(perfectserver, true,
181 cacertreq.filename, servercertreq.filename, false);
182 TLS_TEST_REG(perfectclient, false,
183 cacertreq.filename, clientcertreq.filename, false);
184
185
186 /* Some other CAs which are good */
187
188 /* Basic:CA:critical */
189 TLS_ROOT_REQ(cacert1req,
190 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
191 true, true, true,
192 false, false, 0,
193 false, false, NULL, NULL,
194 0, 0);
195 TLS_CERT_REQ(servercert1req, cacert1req,
196 "UK", "qemu.org", NULL, NULL, NULL, NULL,
197 true, true, false,
198 true, true,
199 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
200 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
201 0, 0);
202
203 /* Basic:CA:not-critical */
204 TLS_ROOT_REQ(cacert2req,
205 "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
206 true, false, true,
207 false, false, 0,
208 false, false, NULL, NULL,
209 0, 0);
210 TLS_CERT_REQ(servercert2req, cacert2req,
211 "UK", "qemu.org", NULL, NULL, NULL, NULL,
212 true, true, false,
213 true, true,
214 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
215 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
216 0, 0);
217
218 /* Key usage:cert-sign:critical */
219 TLS_ROOT_REQ(cacert3req,
220 "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
221 true, true, true,
222 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
223 false, false, NULL, NULL,
224 0, 0);
225 TLS_CERT_REQ(servercert3req, cacert3req,
226 "UK", "qemu.org", NULL, NULL, NULL, NULL,
227 true, true, false,
228 true, true,
229 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
230 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
231 0, 0);
232
233 TLS_TEST_REG(goodca1, true,
234 cacert1req.filename, servercert1req.filename, false);
235 TLS_TEST_REG(goodca2, true,
236 cacert2req.filename, servercert2req.filename, false);
237 TLS_TEST_REG(goodca3, true,
238 cacert3req.filename, servercert3req.filename, false);
239
240 /* Now some bad certs */
241
242 /* Key usage:dig-sig:not-critical */
243 TLS_ROOT_REQ(cacert4req,
244 "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
245 true, true, true,
246 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
247 false, false, NULL, NULL,
248 0, 0);
249 TLS_CERT_REQ(servercert4req, cacert4req,
250 "UK", "qemu.org", NULL, NULL, NULL, NULL,
251 true, true, false,
252 true, true,
253 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
254 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
255 0, 0);
256 /* no-basic */
257 TLS_ROOT_REQ(cacert5req,
258 "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
259 false, false, false,
260 false, false, 0,
261 false, false, NULL, NULL,
262 0, 0);
263 TLS_CERT_REQ(servercert5req, cacert5req,
264 "UK", "qemu.org", NULL, NULL, NULL, NULL,
265 true, true, false,
266 true, true,
267 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
268 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
269 0, 0);
270 /* Key usage:dig-sig:critical */
271 TLS_ROOT_REQ(cacert6req,
272 "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
273 true, true, true,
274 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
275 false, false, NULL, NULL,
276 0, 0);
277 TLS_CERT_REQ(servercert6req, cacert6req,
278 "UK", "qemu.org", NULL, NULL, NULL, NULL,
279 true, true, false,
280 true, true,
281 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
282 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
283 0, 0);
284
9a2fd434 285 TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
a0722409 286 true);
9a2fd434
DB		 287 TLS_TEST_REG(badca2, true,
288 cacert5req.filename, servercert5req.filename, true);
289 TLS_TEST_REG(badca3, true,
290 cacert6req.filename, servercert6req.filename, true);
291
292
293 /* Various good servers */
294 /* no usage or purpose */
295 TLS_CERT_REQ(servercert7req, cacertreq,
296 "UK", "qemu", NULL, NULL, NULL, NULL,
297 true, true, false,
298 false, false, 0,
299 false, false, NULL, NULL,
300 0, 0);
301 /* usage:cert-sign+dig-sig+encipher:critical */
302 TLS_CERT_REQ(servercert8req, cacertreq,
303 "UK", "qemu", NULL, NULL, NULL, NULL,
304 true, true, false,
305 true, true,
306 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
307 GNUTLS_KEY_KEY_CERT_SIGN,
308 false, false, NULL, NULL,
309 0, 0);
310 /* usage:cert-sign:not-critical */
311 TLS_CERT_REQ(servercert9req, cacertreq,
312 "UK", "qemu", NULL, NULL, NULL, NULL,
313 true, true, false,
314 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
315 false, false, NULL, NULL,
316 0, 0);
317 /* purpose:server:critical */
318 TLS_CERT_REQ(servercert10req, cacertreq,
319 "UK", "qemu", NULL, NULL, NULL, NULL,
320 true, true, false,
321 false, false, 0,
322 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
323 0, 0);
324 /* purpose:server:not-critical */
325 TLS_CERT_REQ(servercert11req, cacertreq,
326 "UK", "qemu", NULL, NULL, NULL, NULL,
327 true, true, false,
328 false, false, 0,
329 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
330 0, 0);
331 /* purpose:client+server:critical */
332 TLS_CERT_REQ(servercert12req, cacertreq,
333 "UK", "qemu", NULL, NULL, NULL, NULL,
334 true, true, false,
335 false, false, 0,
336 true, true,
337 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
338 0, 0);
339 /* purpose:client+server:not-critical */
340 TLS_CERT_REQ(servercert13req, cacertreq,
341 "UK", "qemu", NULL, NULL, NULL, NULL,
342 true, true, false,
343 false, false, 0,
344 true, false,
345 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
346 0, 0);
347
348 TLS_TEST_REG(goodserver1, true,
349 cacertreq.filename, servercert7req.filename, false);
350 TLS_TEST_REG(goodserver2, true,
351 cacertreq.filename, servercert8req.filename, false);
352 TLS_TEST_REG(goodserver3, true,
353 cacertreq.filename, servercert9req.filename, false);
354 TLS_TEST_REG(goodserver4, true,
355 cacertreq.filename, servercert10req.filename, false);
356 TLS_TEST_REG(goodserver5, true,
357 cacertreq.filename, servercert11req.filename, false);
358 TLS_TEST_REG(goodserver6, true,
359 cacertreq.filename, servercert12req.filename, false);
360 TLS_TEST_REG(goodserver7, true,
361 cacertreq.filename, servercert13req.filename, false);
362
363 /* Bad servers */
364
365 /* usage:cert-sign:critical */
366 TLS_CERT_REQ(servercert14req, cacertreq,
367 "UK", "qemu", NULL, NULL, NULL, NULL,
368 true, true, false,
369 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
370 false, false, NULL, NULL,
371 0, 0);
372 /* purpose:client:critical */
373 TLS_CERT_REQ(servercert15req, cacertreq,
374 "UK", "qemu", NULL, NULL, NULL, NULL,
375 true, true, false,
376 false, false, 0,
377 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
378 0, 0);
379 /* usage: none:critical */
380 TLS_CERT_REQ(servercert16req, cacertreq,
381 "UK", "qemu", NULL, NULL, NULL, NULL,
382 true, true, false,
383 true, true, 0,
384 false, false, NULL, NULL,
385 0, 0);
386
387 TLS_TEST_REG(badserver1, true,
388 cacertreq.filename, servercert14req.filename, true);
389 TLS_TEST_REG(badserver2, true,
390 cacertreq.filename, servercert15req.filename, true);
391 TLS_TEST_REG(badserver3, true,
392 cacertreq.filename, servercert16req.filename, true);
393
394
395
396 /* Various good clients */
397 /* no usage or purpose */
398 TLS_CERT_REQ(clientcert1req, cacertreq,
399 "UK", "qemu", NULL, NULL, NULL, NULL,
400 true, true, false,
401 false, false, 0,
402 false, false, NULL, NULL,
403 0, 0);
404 /* usage:cert-sign+dig-sig+encipher:critical */
405 TLS_CERT_REQ(clientcert2req, cacertreq,
406 "UK", "qemu", NULL, NULL, NULL, NULL,
407 true, true, false,
408 true, true,
409 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
410 GNUTLS_KEY_KEY_CERT_SIGN,
411 false, false, NULL, NULL,
412 0, 0);
413 /* usage:cert-sign:not-critical */
414 TLS_CERT_REQ(clientcert3req, cacertreq,
415 "UK", "qemu", NULL, NULL, NULL, NULL,
416 true, true, false,
417 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
418 false, false, NULL, NULL,
419 0, 0);
420 /* purpose:client:critical */
421 TLS_CERT_REQ(clientcert4req, cacertreq,
422 "UK", "qemu", NULL, NULL, NULL, NULL,
423 true, true, false,
424 false, false, 0,
425 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
426 0, 0);
427 /* purpose:client:not-critical */
428 TLS_CERT_REQ(clientcert5req, cacertreq,
429 "UK", "qemu", NULL, NULL, NULL, NULL,
430 true, true, false,
431 false, false, 0,
432 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
433 0, 0);
434 /* purpose:client+client:critical */
435 TLS_CERT_REQ(clientcert6req, cacertreq,
436 "UK", "qemu", NULL, NULL, NULL, NULL,
437 true, true, false,
438 false, false, 0,
439 true, true,
440 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
441 0, 0);
442 /* purpose:client+client:not-critical */
443 TLS_CERT_REQ(clientcert7req, cacertreq,
444 "UK", "qemu", NULL, NULL, NULL, NULL,
445 true, true, false,
446 false, false, 0,
447 true, false,
448 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
449 0, 0);
450
451 TLS_TEST_REG(goodclient1, false,
452 cacertreq.filename, clientcert1req.filename, false);
453 TLS_TEST_REG(goodclient2, false,
454 cacertreq.filename, clientcert2req.filename, false);
455 TLS_TEST_REG(goodclient3, false,
456 cacertreq.filename, clientcert3req.filename, false);
457 TLS_TEST_REG(goodclient4, false,
458 cacertreq.filename, clientcert4req.filename, false);
459 TLS_TEST_REG(goodclient5, false,
460 cacertreq.filename, clientcert5req.filename, false);
461 TLS_TEST_REG(goodclient6, false,
462 cacertreq.filename, clientcert6req.filename, false);
463 TLS_TEST_REG(goodclient7, false,
464 cacertreq.filename, clientcert7req.filename, false);
465
466 /* Bad clients */
467
468 /* usage:cert-sign:critical */
469 TLS_CERT_REQ(clientcert8req, cacertreq,
470 "UK", "qemu", NULL, NULL, NULL, NULL,
471 true, true, false,
472 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
473 false, false, NULL, NULL,
474 0, 0);
475 /* purpose:client:critical */
476 TLS_CERT_REQ(clientcert9req, cacertreq,
477 "UK", "qemu", NULL, NULL, NULL, NULL,
478 true, true, false,
479 false, false, 0,
480 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
481 0, 0);
482 /* usage: none:critical */
483 TLS_CERT_REQ(clientcert10req, cacertreq,
484 "UK", "qemu", NULL, NULL, NULL, NULL,
485 true, true, false,
486 true, true, 0,
487 false, false, NULL, NULL,
488 0, 0);
489
490 TLS_TEST_REG(badclient1, false,
491 cacertreq.filename, clientcert8req.filename, true);
492 TLS_TEST_REG(badclient2, false,
493 cacertreq.filename, clientcert9req.filename, true);
494 TLS_TEST_REG(badclient3, false,
495 cacertreq.filename, clientcert10req.filename, true);
496
497
498
499 /* Expired stuff */
500
501 TLS_ROOT_REQ(cacertexpreq,
502 "UK", "qemu", NULL, NULL, NULL, NULL,
503 true, true, true,
504 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
505 false, false, NULL, NULL,
506 0, -1);
507 TLS_CERT_REQ(servercertexpreq, cacertexpreq,
508 "UK", "qemu.org", NULL, NULL, NULL, NULL,
509 true, true, false,
510 true, true,
511 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
512 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
513 0, 0);
514 TLS_CERT_REQ(servercertexp1req, cacertreq,
515 "UK", "qemu", NULL, NULL, NULL, NULL,
516 true, true, false,
517 true, true,
518 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
519 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
520 0, -1);
521 TLS_CERT_REQ(clientcertexp1req, cacertreq,
522 "UK", "qemu", NULL, NULL, NULL, NULL,
523 true, true, false,
524 true, true,
525 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
526 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
527 0, -1);
528
529 TLS_TEST_REG(expired1, true,
530 cacertexpreq.filename, servercertexpreq.filename, true);
531 TLS_TEST_REG(expired2, true,
532 cacertreq.filename, servercertexp1req.filename, true);
533 TLS_TEST_REG(expired3, false,
534 cacertreq.filename, clientcertexp1req.filename, true);
535
536
537 /* Not activated stuff */
538
539 TLS_ROOT_REQ(cacertnewreq,
540 "UK", "qemu", NULL, NULL, NULL, NULL,
541 true, true, true,
542 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
543 false, false, NULL, NULL,
544 1, 2);
545 TLS_CERT_REQ(servercertnewreq, cacertnewreq,
546 "UK", "qemu", NULL, NULL, NULL, NULL,
547 true, true, false,
548 true, true,
549 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
550 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
551 0, 0);
552 TLS_CERT_REQ(servercertnew1req, cacertreq,
553 "UK", "qemu", NULL, NULL, NULL, NULL,
554 true, true, false,
555 true, true,
556 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
557 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
558 1, 2);
559 TLS_CERT_REQ(clientcertnew1req, cacertreq,
560 "UK", "qemu", NULL, NULL, NULL, NULL,
561 true, true, false,
562 true, true,
563 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
564 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
565 1, 2);
566
567 TLS_TEST_REG(inactive1, true,
568 cacertnewreq.filename, servercertnewreq.filename, true);
569 TLS_TEST_REG(inactive2, true,
570 cacertreq.filename, servercertnew1req.filename, true);
571 TLS_TEST_REG(inactive3, false,
572 cacertreq.filename, clientcertnew1req.filename, true);
573
574 TLS_ROOT_REQ(cacertrootreq,
575 "UK", "qemu root", NULL, NULL, NULL, NULL,
576 true, true, true,
577 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
578 false, false, NULL, NULL,
579 0, 0);
580 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
581 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
582 true, true, true,
583 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
584 false, false, NULL, NULL,
585 0, 0);
586 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
587 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
588 true, true, true,
589 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
590 false, false, NULL, NULL,
591 0, 0);
592 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
593 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
594 true, true, true,
595 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
596 false, false, NULL, NULL,
597 0, 0);
598 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
599 "UK", "qemu.org", NULL, NULL, NULL, NULL,
600 true, true, false,
601 true, true,
602 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
603 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
604 0, 0);
605 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
606 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
607 true, true, false,
608 true, true,
609 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
610 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
611 0, 0);
612
613 gnutls_x509_crt_t certchain[] = {
614 cacertrootreq.crt,
615 cacertlevel1areq.crt,
616 cacertlevel1breq.crt,
617 cacertlevel2areq.crt,
618 };
619
620 test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
621 certchain,
622 G_N_ELEMENTS(certchain));
623
624 TLS_TEST_REG(chain1, true,
625 WORKDIR "cacertchain-ctx.pem",
626 servercertlevel3areq.filename, false);
627 TLS_TEST_REG(chain2, false,
628 WORKDIR "cacertchain-ctx.pem",
629 clientcertlevel2breq.filename, false);
630
631 /* Some missing certs - first two are fatal, the last
632 * is ok
633 */
634 TLS_TEST_REG(missingca, true,
635 "cacertdoesnotexist.pem",
636 servercert1req.filename, true);
637 TLS_TEST_REG(missingserver, true,
638 cacert1req.filename,
639 "servercertdoesnotexist.pem", true);
640 TLS_TEST_REG(missingclient, false,
641 cacert1req.filename,
642 "clientcertdoesnotexist.pem", false);
643
644 ret = g_test_run();
645
646 test_tls_discard_cert(&cacertreq);
647 test_tls_discard_cert(&cacert1req);
648 test_tls_discard_cert(&cacert2req);
649 test_tls_discard_cert(&cacert3req);
650 test_tls_discard_cert(&cacert4req);
651 test_tls_discard_cert(&cacert5req);
652 test_tls_discard_cert(&cacert6req);
653
654 test_tls_discard_cert(&servercertreq);
655 test_tls_discard_cert(&servercert1req);
656 test_tls_discard_cert(&servercert2req);
657 test_tls_discard_cert(&servercert3req);
658 test_tls_discard_cert(&servercert4req);
659 test_tls_discard_cert(&servercert5req);
660 test_tls_discard_cert(&servercert6req);
661 test_tls_discard_cert(&servercert7req);
662 test_tls_discard_cert(&servercert8req);
663 test_tls_discard_cert(&servercert9req);
664 test_tls_discard_cert(&servercert10req);
665 test_tls_discard_cert(&servercert11req);
666 test_tls_discard_cert(&servercert12req);
667 test_tls_discard_cert(&servercert13req);
668 test_tls_discard_cert(&servercert14req);
669 test_tls_discard_cert(&servercert15req);
670 test_tls_discard_cert(&servercert16req);
671
672 test_tls_discard_cert(&clientcertreq);
673 test_tls_discard_cert(&clientcert1req);
674 test_tls_discard_cert(&clientcert2req);
675 test_tls_discard_cert(&clientcert3req);
676 test_tls_discard_cert(&clientcert4req);
677 test_tls_discard_cert(&clientcert5req);
678 test_tls_discard_cert(&clientcert6req);
679 test_tls_discard_cert(&clientcert7req);
680 test_tls_discard_cert(&clientcert8req);
681 test_tls_discard_cert(&clientcert9req);
682 test_tls_discard_cert(&clientcert10req);
683
684 test_tls_discard_cert(&cacertexpreq);
685 test_tls_discard_cert(&servercertexpreq);
686 test_tls_discard_cert(&servercertexp1req);
687 test_tls_discard_cert(&clientcertexp1req);
688
689 test_tls_discard_cert(&cacertnewreq);
690 test_tls_discard_cert(&servercertnewreq);
691 test_tls_discard_cert(&servercertnew1req);
692 test_tls_discard_cert(&clientcertnew1req);
693
694 test_tls_discard_cert(&cacertrootreq);
695 test_tls_discard_cert(&cacertlevel1areq);
696 test_tls_discard_cert(&cacertlevel1breq);
697 test_tls_discard_cert(&cacertlevel2areq);
698 test_tls_discard_cert(&servercertlevel3areq);
699 test_tls_discard_cert(&clientcertlevel2breq);
700 unlink(WORKDIR "cacertchain-ctx.pem");
701
702 test_tls_cleanup(KEYFILE);
703 rmdir(WORKDIR);
704
705 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
706}
QEMU mirror