static int mymain(void) { int ret = 0; setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); testTLSInit(KEYFILE); # define DO_CTX_TEST(_isServer, _caCrt, _crt, _expectFail) \ do { \ static struct testTLSContextData data; \ data.isServer = _isServer; \ data.cacrt = _caCrt; \ data.crt = _crt; \ data.expectFail = _expectFail; \ if (virTestRun("TLS Context " #_caCrt " + " #_crt, \ testTLSContextInit, &data) < 0) \ ret = -1; \ } while (0) # define TLS_CERT_REQ(varname, cavarname, \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \ static struct testTLSCertReq varname = { \ NULL, #varname "-ctx.pem", \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo \ }; \ testTLSGenerateCert(&varname, cavarname.crt) # define TLS_ROOT_REQ(varname, \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \ static struct testTLSCertReq varname = { \ NULL, #varname "-ctx.pem", \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo \ }; \ testTLSGenerateCert(&varname, NULL) /* A perfect CA, perfect client & perfect server */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacertreq, "UK", "libvirt CA", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertreq, cacertreq, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); DO_CTX_TEST(true, cacertreq.filename, servercertreq.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcertreq.filename, false); /* Some other CAs which are good */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacert1req, "UK", "libvirt CA 1", NULL, NULL, NULL, NULL, true, true, true, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert1req, cacert1req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Basic:CA:not-critical */ TLS_ROOT_REQ(cacert2req, "UK", "libvirt CA 2", NULL, NULL, NULL, NULL, true, false, true, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert2req, cacert2req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Key usage:cert-sign:critical */ TLS_ROOT_REQ(cacert3req, "UK", "libvirt CA 3", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert3req, cacert3req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); DO_CTX_TEST(true, cacert1req.filename, servercert1req.filename, false); DO_CTX_TEST(true, cacert2req.filename, servercert2req.filename, false); DO_CTX_TEST(true, cacert3req.filename, servercert3req.filename, false); /* Now some bad certs */ /* Key usage:dig-sig:not-critical */ TLS_ROOT_REQ(cacert4req, "UK", "libvirt CA 4", NULL, NULL, NULL, NULL, true, true, true, true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert4req, cacert4req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* no-basic */ TLS_ROOT_REQ(cacert5req, "UK", "libvirt CA 5", NULL, NULL, NULL, NULL, false, false, false, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert5req, cacert5req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Key usage:dig-sig:critical */ TLS_ROOT_REQ(cacert6req, "UK", "libvirt CA 6", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert6req, cacert6req, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Technically a CA cert with basic constraints * key purpose == key signing + non-critical should * be rejected. GNUTLS < 3.1 does not reject it and * we don't anticipate them changing this behaviour */ DO_CTX_TEST(true, cacert4req.filename, servercert4req.filename, (GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) || GNUTLS_VERSION_MAJOR > 3); DO_CTX_TEST(true, cacert5req.filename, servercert5req.filename, true); DO_CTX_TEST(true, cacert6req.filename, servercert6req.filename, true); /* Various good servers */ /* no usage or purpose */ TLS_CERT_REQ(servercert7req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, false, false, NULL, NULL, 0, 0); /* usage:cert-sign+dig-sig+encipher:critical */ TLS_CERT_REQ(servercert8req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* usage:cert-sign:not-critical */ TLS_CERT_REQ(servercert9req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, false, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:server:critical */ TLS_CERT_REQ(servercert10req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* purpose:server:not-critical */ TLS_CERT_REQ(servercert11req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* purpose:client+server:critical */ TLS_CERT_REQ(servercert12req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); /* purpose:client+server:not-critical */ TLS_CERT_REQ(servercert13req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); DO_CTX_TEST(true, cacertreq.filename, servercert7req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert8req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert9req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert10req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert11req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert12req.filename, false); DO_CTX_TEST(true, cacertreq.filename, servercert13req.filename, false); /* Bad servers */ /* usage:cert-sign:critical */ TLS_CERT_REQ(servercert14req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(servercert15req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* usage: none:critical */ TLS_CERT_REQ(servercert16req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, 0, false, false, NULL, NULL, 0, 0); DO_CTX_TEST(true, cacertreq.filename, servercert14req.filename, true); DO_CTX_TEST(true, cacertreq.filename, servercert15req.filename, true); DO_CTX_TEST(true, cacertreq.filename, servercert16req.filename, true); /* Various good clients */ /* no usage or purpose */ TLS_CERT_REQ(clientcert1req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, false, false, NULL, NULL, 0, 0); /* usage:cert-sign+dig-sig+encipher:critical */ TLS_CERT_REQ(clientcert2req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* usage:cert-sign:not-critical */ TLS_CERT_REQ(clientcert3req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, false, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(clientcert4req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* purpose:client:not-critical */ TLS_CERT_REQ(clientcert5req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* purpose:client+client:critical */ TLS_CERT_REQ(clientcert6req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); /* purpose:client+client:not-critical */ TLS_CERT_REQ(clientcert7req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); DO_CTX_TEST(false, cacertreq.filename, clientcert1req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert2req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert3req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert4req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert5req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert6req.filename, false); DO_CTX_TEST(false, cacertreq.filename, clientcert7req.filename, false); /* Bad clients */ /* usage:cert-sign:critical */ TLS_CERT_REQ(clientcert8req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(clientcert9req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* usage: none:critical */ TLS_CERT_REQ(clientcert10req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, 0, false, false, NULL, NULL, 0, 0); DO_CTX_TEST(false, cacertreq.filename, clientcert8req.filename, true); DO_CTX_TEST(false, cacertreq.filename, clientcert9req.filename, true); DO_CTX_TEST(false, cacertreq.filename, clientcert10req.filename, true); /* Expired stuff */ TLS_ROOT_REQ(cacertexpreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, -1); TLS_CERT_REQ(servercertexpreq, cacertexpreq, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertexp1req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, -1); TLS_CERT_REQ(clientcertexp1req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, -1); DO_CTX_TEST(true, cacertexpreq.filename, servercertexpreq.filename, true); DO_CTX_TEST(true, cacertreq.filename, servercertexp1req.filename, true); DO_CTX_TEST(false, cacertreq.filename, clientcertexp1req.filename, true); /* Not activated stuff */ TLS_ROOT_REQ(cacertnewreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 1, 2); TLS_CERT_REQ(servercertnewreq, cacertnewreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertnew1req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 1, 2); TLS_CERT_REQ(clientcertnew1req, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 1, 2); DO_CTX_TEST(true, cacertnewreq.filename, servercertnewreq.filename, true); DO_CTX_TEST(true, cacertreq.filename, servercertnew1req.filename, true); DO_CTX_TEST(false, cacertreq.filename, clientcertnew1req.filename, true); TLS_ROOT_REQ(cacertrootreq, "UK", "libvirt root", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, "UK", "libvirt level 1a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1breq, cacertrootreq, "UK", "libvirt level 1b", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, "UK", "libvirt level 2a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, "UK", "libvirt client level 2b", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); gnutls_x509_crt_t certchain[] = { cacertrootreq.crt, cacertlevel1areq.crt, cacertlevel1breq.crt, cacertlevel2areq.crt, }; testTLSWriteCertChain("cacertchain-ctx.pem", certchain, ARRAY_CARDINALITY(certchain)); DO_CTX_TEST(true, "cacertchain-ctx.pem", servercertlevel3areq.filename, false); DO_CTX_TEST(false, "cacertchain-ctx.pem", clientcertlevel2breq.filename, false); DO_CTX_TEST(false, "cacertdoesnotexist.pem", "servercertdoesnotexist.pem", true); testTLSDiscardCert(&cacertreq); testTLSDiscardCert(&cacert1req); testTLSDiscardCert(&cacert2req); testTLSDiscardCert(&cacert3req); testTLSDiscardCert(&cacert4req); testTLSDiscardCert(&cacert5req); testTLSDiscardCert(&cacert6req); testTLSDiscardCert(&servercertreq); testTLSDiscardCert(&servercert1req); testTLSDiscardCert(&servercert2req); testTLSDiscardCert(&servercert3req); testTLSDiscardCert(&servercert4req); testTLSDiscardCert(&servercert5req); testTLSDiscardCert(&servercert6req); testTLSDiscardCert(&servercert7req); testTLSDiscardCert(&servercert8req); testTLSDiscardCert(&servercert9req); testTLSDiscardCert(&servercert10req); testTLSDiscardCert(&servercert11req); testTLSDiscardCert(&servercert12req); testTLSDiscardCert(&servercert13req); testTLSDiscardCert(&servercert14req); testTLSDiscardCert(&servercert15req); testTLSDiscardCert(&servercert16req); testTLSDiscardCert(&clientcertreq); testTLSDiscardCert(&clientcert1req); testTLSDiscardCert(&clientcert2req); testTLSDiscardCert(&clientcert3req); testTLSDiscardCert(&clientcert4req); testTLSDiscardCert(&clientcert5req); testTLSDiscardCert(&clientcert6req); testTLSDiscardCert(&clientcert7req); testTLSDiscardCert(&clientcert8req); testTLSDiscardCert(&clientcert9req); testTLSDiscardCert(&clientcert10req); testTLSDiscardCert(&cacertexpreq); testTLSDiscardCert(&servercertexpreq); testTLSDiscardCert(&servercertexp1req); testTLSDiscardCert(&clientcertexp1req); testTLSDiscardCert(&cacertnewreq); testTLSDiscardCert(&servercertnewreq); testTLSDiscardCert(&servercertnew1req); testTLSDiscardCert(&clientcertnew1req); testTLSDiscardCert(&cacertrootreq); testTLSDiscardCert(&cacertlevel1areq); testTLSDiscardCert(&cacertlevel1breq); testTLSDiscardCert(&cacertlevel2areq); testTLSDiscardCert(&servercertlevel3areq); testTLSDiscardCert(&clientcertlevel2breq); unlink("cacertchain-ctx.pem"); testTLSCleanup(KEYFILE); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; }
static int mymain(void) { int ret = 0; setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); testTLSInit(KEYFILE); # define DO_SESS_TEST(_caCrt, _serverCrt, _clientCrt, _expectServerFail, \ _expectClientFail, _hostname, _wildcards) \ do { \ static struct testTLSSessionData data; \ data.servercacrt = _caCrt; \ data.clientcacrt = _caCrt; \ data.servercrt = _serverCrt; \ data.clientcrt = _clientCrt; \ data.expectServerFail = _expectServerFail; \ data.expectClientFail = _expectClientFail; \ data.hostname = _hostname; \ data.wildcards = _wildcards; \ if (virTestRun("TLS Session " #_serverCrt " + " #_clientCrt, \ testTLSSessionInit, &data) < 0) \ ret = -1; \ } while (0) # define DO_SESS_TEST_EXT(_serverCaCrt, _clientCaCrt, _serverCrt, _clientCrt, \ _expectServerFail, _expectClientFail, \ _hostname, _wildcards) \ do { \ static struct testTLSSessionData data; \ data.servercacrt = _serverCaCrt; \ data.clientcacrt = _clientCaCrt; \ data.servercrt = _serverCrt; \ data.clientcrt = _clientCrt; \ data.expectServerFail = _expectServerFail; \ data.expectClientFail = _expectClientFail; \ data.hostname = _hostname; \ data.wildcards = _wildcards; \ if (virTestRun("TLS Session " #_serverCrt " + " #_clientCrt, \ testTLSSessionInit, &data) < 0) \ ret = -1; \ } while (0) # define TLS_CERT_REQ(varname, cavarname, \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \ static struct testTLSCertReq varname = { \ NULL, #varname "-sess.pem", \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, so \ }; \ testTLSGenerateCert(&varname, cavarname.crt) # define TLS_ROOT_REQ(varname, \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \ static struct testTLSCertReq varname = { \ NULL, #varname "-sess.pem", \ co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \ kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, so \ }; \ testTLSGenerateCert(&varname, NULL) /* A perfect CA, perfect client & perfect server */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacertreq, "UK", "libvirt CA", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_ROOT_REQ(altcacertreq, "UK", "libvirt CA 1", NULL, NULL, NULL, NULL, true, true, true, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertreq, cacertreq, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); TLS_CERT_REQ(clientcertaltreq, altcacertreq, "UK", "libvirt", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "libvirt.org", NULL); DO_SESS_TEST_EXT(cacertreq.filename, altcacertreq.filename, servercertreq.filename, clientcertaltreq.filename, true, true, "libvirt.org", NULL); /* When an altname is set, the CN is ignored, so it must be duplicated * as an altname for it to match */ TLS_CERT_REQ(servercertalt1req, cacertreq, "UK", "libvirt.org", "www.libvirt.org", "libvirt.org", "192.168.122.1", "fec0::dead:beaf", true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* This intentionally doesn't replicate */ TLS_CERT_REQ(servercertalt2req, cacertreq, "UK", "libvirt.org", "www.libvirt.org", "wiki.libvirt.org", "192.168.122.1", "fec0::dead:beaf", true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); DO_SESS_TEST(cacertreq.filename, servercertalt1req.filename, clientcertreq.filename, false, false, "libvirt.org", NULL); DO_SESS_TEST(cacertreq.filename, servercertalt1req.filename, clientcertreq.filename, false, false, "www.libvirt.org", NULL); DO_SESS_TEST(cacertreq.filename, servercertalt1req.filename, clientcertreq.filename, false, true, "wiki.libvirt.org", NULL); DO_SESS_TEST(cacertreq.filename, servercertalt2req.filename, clientcertreq.filename, false, true, "libvirt.org", NULL); DO_SESS_TEST(cacertreq.filename, servercertalt2req.filename, clientcertreq.filename, false, false, "www.libvirt.org", NULL); DO_SESS_TEST(cacertreq.filename, servercertalt2req.filename, clientcertreq.filename, false, false, "wiki.libvirt.org", NULL); const char *const wildcards1[] = { "C=UK,CN=dogfood", NULL, }; const char *const wildcards2[] = { "C=UK,CN=libvirt", NULL, }; const char *const wildcards3[] = { "C=UK,CN=dogfood", "C=UK,CN=libvirt", NULL, }; const char *const wildcards4[] = { "C=UK,CN=libvirtstuff", NULL, }; const char *const wildcards5[] = { "C=UK,CN=libvirt*", NULL, }; const char *const wildcards6[] = { "C=UK,CN=*virt*", NULL, }; DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, true, false, "libvirt.org", wildcards1); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "libvirt.org", wildcards2); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "libvirt.org", wildcards3); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, true, false, "libvirt.org", wildcards4); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "libvirt.org", wildcards5); DO_SESS_TEST(cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "libvirt.org", wildcards6); TLS_ROOT_REQ(cacertrootreq, "UK", "libvirt root", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, "UK", "libvirt level 1a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1breq, cacertrootreq, "UK", "libvirt level 1b", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, "UK", "libvirt level 2a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq, "UK", "libvirt.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, "UK", "libvirt client level 2b", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); gnutls_x509_crt_t certchain[] = { cacertrootreq.crt, cacertlevel1areq.crt, cacertlevel1breq.crt, cacertlevel2areq.crt, }; testTLSWriteCertChain("cacertchain-sess.pem", certchain, ARRAY_CARDINALITY(certchain)); DO_SESS_TEST("cacertchain-sess.pem", servercertlevel3areq.filename, clientcertlevel2breq.filename, false, false, "libvirt.org", NULL); testTLSDiscardCert(&clientcertreq); testTLSDiscardCert(&clientcertaltreq); testTLSDiscardCert(&servercertreq); testTLSDiscardCert(&servercertalt1req); testTLSDiscardCert(&servercertalt2req); testTLSDiscardCert(&cacertreq); testTLSDiscardCert(&altcacertreq); testTLSDiscardCert(&cacertrootreq); testTLSDiscardCert(&cacertlevel1areq); testTLSDiscardCert(&cacertlevel1breq); testTLSDiscardCert(&cacertlevel2areq); testTLSDiscardCert(&servercertlevel3areq); testTLSDiscardCert(&clientcertlevel2breq); unlink("cacertchain-sess.pem"); testTLSCleanup(KEYFILE); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; }
int main(int argc, char **argv) { int ret; g_assert(qcrypto_init(NULL) == 0); module_call_init(MODULE_INIT_QOM); g_test_init(&argc, &argv, NULL); setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); mkdir(WORKDIR, 0700); test_tls_init(KEYFILE); # define TEST_CHANNEL(name, caCrt, \ serverCrt, clientCrt, \ expectServerFail, expectClientFail, \ hostname, wildcards) \ struct QIOChannelTLSTestData name = { \ caCrt, caCrt, serverCrt, clientCrt, \ expectServerFail, expectClientFail, \ hostname, wildcards \ }; \ g_test_add_data_func("/qio/channel/tls/" # name, \ &name, test_io_channel_tls); /* A perfect CA, perfect client & perfect server */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacertreq, "UK", "qemu CA", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertreq, cacertreq, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); const char *const wildcards[] = { "C=UK,CN=qemu*", NULL, }; TEST_CHANNEL(basic, cacertreq.filename, servercertreq.filename, clientcertreq.filename, false, false, "qemu.org", wildcards); ret = g_test_run(); test_tls_discard_cert(&clientcertreq); test_tls_discard_cert(&servercertreq); test_tls_discard_cert(&cacertreq); test_tls_cleanup(KEYFILE); rmdir(WORKDIR); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; }
int main(int argc, char **argv) { int ret; module_call_init(MODULE_INIT_QOM); g_test_init(&argc, &argv, NULL); setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1); mkdir(WORKDIR, 0700); test_tls_init(KEYFILE); # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail) \ struct QCryptoTLSCredsTestData name = { \ isServer, caCrt, crt, expectFail \ }; \ g_test_add_data_func("/qcrypto/tlscredsx509/" # name, \ &name, test_tls_creds); \ /* A perfect CA, perfect client & perfect server */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacertreq, "UK", "qemu CA", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertreq, cacertreq, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertreq, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); TLS_TEST_REG(perfectserver, true, cacertreq.filename, servercertreq.filename, false); TLS_TEST_REG(perfectclient, false, cacertreq.filename, clientcertreq.filename, false); /* Some other CAs which are good */ /* Basic:CA:critical */ TLS_ROOT_REQ(cacert1req, "UK", "qemu CA 1", NULL, NULL, NULL, NULL, true, true, true, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert1req, cacert1req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Basic:CA:not-critical */ TLS_ROOT_REQ(cacert2req, "UK", "qemu CA 2", NULL, NULL, NULL, NULL, true, false, true, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert2req, cacert2req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Key usage:cert-sign:critical */ TLS_ROOT_REQ(cacert3req, "UK", "qemu CA 3", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert3req, cacert3req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_TEST_REG(goodca1, true, cacert1req.filename, servercert1req.filename, false); TLS_TEST_REG(goodca2, true, cacert2req.filename, servercert2req.filename, false); TLS_TEST_REG(goodca3, true, cacert3req.filename, servercert3req.filename, false); /* Now some bad certs */ /* Key usage:dig-sig:not-critical */ TLS_ROOT_REQ(cacert4req, "UK", "qemu CA 4", NULL, NULL, NULL, NULL, true, true, true, true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert4req, cacert4req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* no-basic */ TLS_ROOT_REQ(cacert5req, "UK", "qemu CA 5", NULL, NULL, NULL, NULL, false, false, false, false, false, 0, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert5req, cacert5req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Key usage:dig-sig:critical */ TLS_ROOT_REQ(cacert6req, "UK", "qemu CA 6", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercert6req, cacert6req, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* Technically a CA cert with basic constraints * key purpose == key signing + non-critical should * be rejected. GNUTLS < 3.1 does not reject it and * we don't anticipate them changing this behaviour */ TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename, (GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) || GNUTLS_VERSION_MAJOR > 3); TLS_TEST_REG(badca2, true, cacert5req.filename, servercert5req.filename, true); TLS_TEST_REG(badca3, true, cacert6req.filename, servercert6req.filename, true); /* Various good servers */ /* no usage or purpose */ TLS_CERT_REQ(servercert7req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, false, false, NULL, NULL, 0, 0); /* usage:cert-sign+dig-sig+encipher:critical */ TLS_CERT_REQ(servercert8req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* usage:cert-sign:not-critical */ TLS_CERT_REQ(servercert9req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, false, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:server:critical */ TLS_CERT_REQ(servercert10req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* purpose:server:not-critical */ TLS_CERT_REQ(servercert11req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* purpose:client+server:critical */ TLS_CERT_REQ(servercert12req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); /* purpose:client+server:not-critical */ TLS_CERT_REQ(servercert13req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); TLS_TEST_REG(goodserver1, true, cacertreq.filename, servercert7req.filename, false); TLS_TEST_REG(goodserver2, true, cacertreq.filename, servercert8req.filename, false); TLS_TEST_REG(goodserver3, true, cacertreq.filename, servercert9req.filename, false); TLS_TEST_REG(goodserver4, true, cacertreq.filename, servercert10req.filename, false); TLS_TEST_REG(goodserver5, true, cacertreq.filename, servercert11req.filename, false); TLS_TEST_REG(goodserver6, true, cacertreq.filename, servercert12req.filename, false); TLS_TEST_REG(goodserver7, true, cacertreq.filename, servercert13req.filename, false); /* Bad servers */ /* usage:cert-sign:critical */ TLS_CERT_REQ(servercert14req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(servercert15req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* usage: none:critical */ TLS_CERT_REQ(servercert16req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, 0, false, false, NULL, NULL, 0, 0); TLS_TEST_REG(badserver1, true, cacertreq.filename, servercert14req.filename, true); TLS_TEST_REG(badserver2, true, cacertreq.filename, servercert15req.filename, true); TLS_TEST_REG(badserver3, true, cacertreq.filename, servercert16req.filename, true); /* Various good clients */ /* no usage or purpose */ TLS_CERT_REQ(clientcert1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, false, false, NULL, NULL, 0, 0); /* usage:cert-sign+dig-sig+encipher:critical */ TLS_CERT_REQ(clientcert2req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* usage:cert-sign:not-critical */ TLS_CERT_REQ(clientcert3req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, false, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(clientcert4req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* purpose:client:not-critical */ TLS_CERT_REQ(clientcert5req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); /* purpose:client+client:critical */ TLS_CERT_REQ(clientcert6req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); /* purpose:client+client:not-critical */ TLS_CERT_REQ(clientcert7req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER, 0, 0); TLS_TEST_REG(goodclient1, false, cacertreq.filename, clientcert1req.filename, false); TLS_TEST_REG(goodclient2, false, cacertreq.filename, clientcert2req.filename, false); TLS_TEST_REG(goodclient3, false, cacertreq.filename, clientcert3req.filename, false); TLS_TEST_REG(goodclient4, false, cacertreq.filename, clientcert4req.filename, false); TLS_TEST_REG(goodclient5, false, cacertreq.filename, clientcert5req.filename, false); TLS_TEST_REG(goodclient6, false, cacertreq.filename, clientcert6req.filename, false); TLS_TEST_REG(goodclient7, false, cacertreq.filename, clientcert7req.filename, false); /* Bad clients */ /* usage:cert-sign:critical */ TLS_CERT_REQ(clientcert8req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); /* purpose:client:critical */ TLS_CERT_REQ(clientcert9req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, false, false, 0, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); /* usage: none:critical */ TLS_CERT_REQ(clientcert10req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, 0, false, false, NULL, NULL, 0, 0); TLS_TEST_REG(badclient1, false, cacertreq.filename, clientcert8req.filename, true); TLS_TEST_REG(badclient2, false, cacertreq.filename, clientcert9req.filename, true); TLS_TEST_REG(badclient3, false, cacertreq.filename, clientcert10req.filename, true); /* Expired stuff */ TLS_ROOT_REQ(cacertexpreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, -1); TLS_CERT_REQ(servercertexpreq, cacertexpreq, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertexp1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, -1); TLS_CERT_REQ(clientcertexp1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, -1); TLS_TEST_REG(expired1, true, cacertexpreq.filename, servercertexpreq.filename, true); TLS_TEST_REG(expired2, true, cacertreq.filename, servercertexp1req.filename, true); TLS_TEST_REG(expired3, false, cacertreq.filename, clientcertexp1req.filename, true); /* Not activated stuff */ TLS_ROOT_REQ(cacertnewreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 1, 2); TLS_CERT_REQ(servercertnewreq, cacertnewreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(servercertnew1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 1, 2); TLS_CERT_REQ(clientcertnew1req, cacertreq, "UK", "qemu", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 1, 2); TLS_TEST_REG(inactive1, true, cacertnewreq.filename, servercertnewreq.filename, true); TLS_TEST_REG(inactive2, true, cacertreq.filename, servercertnew1req.filename, true); TLS_TEST_REG(inactive3, false, cacertreq.filename, clientcertnew1req.filename, true); TLS_ROOT_REQ(cacertrootreq, "UK", "qemu root", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1areq, cacertrootreq, "UK", "qemu level 1a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel1breq, cacertrootreq, "UK", "qemu level 1b", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq, "UK", "qemu level 2a", NULL, NULL, NULL, NULL, true, true, true, true, true, GNUTLS_KEY_KEY_CERT_SIGN, false, false, NULL, NULL, 0, 0); TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq, "UK", "qemu.org", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL, 0, 0); TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq, "UK", "qemu client level 2b", NULL, NULL, NULL, NULL, true, true, false, true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL, 0, 0); gnutls_x509_crt_t certchain[] = { cacertrootreq.crt, cacertlevel1areq.crt, cacertlevel1breq.crt, cacertlevel2areq.crt, }; test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem", certchain, G_N_ELEMENTS(certchain)); TLS_TEST_REG(chain1, true, WORKDIR "cacertchain-ctx.pem", servercertlevel3areq.filename, false); TLS_TEST_REG(chain2, false, WORKDIR "cacertchain-ctx.pem", clientcertlevel2breq.filename, false); /* Some missing certs - first two are fatal, the last * is ok */ TLS_TEST_REG(missingca, true, "cacertdoesnotexist.pem", servercert1req.filename, true); TLS_TEST_REG(missingserver, true, cacert1req.filename, "servercertdoesnotexist.pem", true); TLS_TEST_REG(missingclient, false, cacert1req.filename, "clientcertdoesnotexist.pem", false); ret = g_test_run(); test_tls_discard_cert(&cacertreq); test_tls_discard_cert(&cacert1req); test_tls_discard_cert(&cacert2req); test_tls_discard_cert(&cacert3req); test_tls_discard_cert(&cacert4req); test_tls_discard_cert(&cacert5req); test_tls_discard_cert(&cacert6req); test_tls_discard_cert(&servercertreq); test_tls_discard_cert(&servercert1req); test_tls_discard_cert(&servercert2req); test_tls_discard_cert(&servercert3req); test_tls_discard_cert(&servercert4req); test_tls_discard_cert(&servercert5req); test_tls_discard_cert(&servercert6req); test_tls_discard_cert(&servercert7req); test_tls_discard_cert(&servercert8req); test_tls_discard_cert(&servercert9req); test_tls_discard_cert(&servercert10req); test_tls_discard_cert(&servercert11req); test_tls_discard_cert(&servercert12req); test_tls_discard_cert(&servercert13req); test_tls_discard_cert(&servercert14req); test_tls_discard_cert(&servercert15req); test_tls_discard_cert(&servercert16req); test_tls_discard_cert(&clientcertreq); test_tls_discard_cert(&clientcert1req); test_tls_discard_cert(&clientcert2req); test_tls_discard_cert(&clientcert3req); test_tls_discard_cert(&clientcert4req); test_tls_discard_cert(&clientcert5req); test_tls_discard_cert(&clientcert6req); test_tls_discard_cert(&clientcert7req); test_tls_discard_cert(&clientcert8req); test_tls_discard_cert(&clientcert9req); test_tls_discard_cert(&clientcert10req); test_tls_discard_cert(&cacertexpreq); test_tls_discard_cert(&servercertexpreq); test_tls_discard_cert(&servercertexp1req); test_tls_discard_cert(&clientcertexp1req); test_tls_discard_cert(&cacertnewreq); test_tls_discard_cert(&servercertnewreq); test_tls_discard_cert(&servercertnew1req); test_tls_discard_cert(&clientcertnew1req); test_tls_discard_cert(&cacertrootreq); test_tls_discard_cert(&cacertlevel1areq); test_tls_discard_cert(&cacertlevel1breq); test_tls_discard_cert(&cacertlevel2areq); test_tls_discard_cert(&servercertlevel3areq); test_tls_discard_cert(&clientcertlevel2breq); unlink(WORKDIR "cacertchain-ctx.pem"); test_tls_cleanup(KEYFILE); rmdir(WORKDIR); return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; }