tests/test-crypto-tlscredsx509.c

   1 /*
   2  * Copyright (C) 2015 Red Hat, Inc.
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library.  If not, see
  16  * <http://www.gnu.org/licenses/>.
  17  *
  18  * Author: Daniel P. Berrange <berrange@redhat.com>
  19  */
  20
  21 #include "qemu/osdep.h"
  22
  23 #include "crypto-tls-x509-helpers.h"
  24 #include "crypto/tlscredsx509.h"
  25 #include "qapi/error.h"
  26 #include "qemu/module.h"
  27
  28 #ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
  29
  30 #define WORKDIR "tests/test-crypto-tlscredsx509-work/"
  31 #define KEYFILE WORKDIR "key-ctx.pem"
  32
  33 struct QCryptoTLSCredsTestData {
  34     bool isServer;
  35     const char *cacrt;
  36     const char *crt;
  37     bool expectFail;
  38 };
  39
  40
  41 static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
  42                                               const char *certdir,
  43                                               Error **errp)
  44 {
  45     Object *parent = object_get_objects_root();
  46     Object *creds = object_new_with_props(
  47         TYPE_QCRYPTO_TLS_CREDS_X509,
  48         parent,
  49         "testtlscreds",
  50         errp,
  51         "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
  52                      "server" : "client"),
  53         "dir", certdir,
  54         "verify-peer", "yes",
  55         "sanity-check", "yes",
  56         NULL);
  57
  58     if (!creds) {
  59         return NULL;
  60     }
  61     return QCRYPTO_TLS_CREDS(creds);
  62 }
  63
  64 /*
  65  * This tests sanity checking of our own certificates
  66  *
  67  * The code being tested is used when TLS creds are created,
  68  * and aim to ensure QMEU has been configured with sane
  69  * certificates. This allows us to give much much much
  70  * clearer error messages to the admin when they misconfigure
  71  * things.
  72  */
  73 static void test_tls_creds(const void *opaque)
  74 {
  75     struct QCryptoTLSCredsTestData *data =
  76         (struct QCryptoTLSCredsTestData *)opaque;
  77     QCryptoTLSCreds *creds;
  78
  79 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
  80     mkdir(CERT_DIR, 0700);
  81
  82     unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
  83     if (data->isServer) {
  84         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
  85         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
  86     } else {
  87         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
  88         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
  89     }
  90
  91     if (access(data->cacrt, R_OK) == 0) {
  92         g_assert(link(data->cacrt,
  93                       CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
  94     }
  95     if (data->isServer) {
  96         if (access(data->crt, R_OK) == 0) {
  97             g_assert(link(data->crt,
  98                           CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
  99         }
 100         g_assert(link(KEYFILE,
 101                       CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
 102     } else {
 103         if (access(data->crt, R_OK) == 0) {
 104             g_assert(link(data->crt,
 105                           CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
 106         }
 107         g_assert(link(KEYFILE,
 108                       CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
 109     }
 110
 111     creds = test_tls_creds_create(
 112         (data->isServer ?
 113          QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
 114          QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
 115         CERT_DIR,
 116         data->expectFail ? NULL : &error_abort);
 117
 118     if (data->expectFail) {
 119         g_assert(creds == NULL);
 120     } else {
 121         g_assert(creds != NULL);
 122     }
 123
 124     unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
 125     if (data->isServer) {
 126         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
 127         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
 128     } else {
 129         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
 130         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
 131     }
 132     rmdir(CERT_DIR);
 133     if (creds) {
 134         object_unparent(OBJECT(creds));
 135     }
 136 }
 137
 138 int main(int argc, char **argv)
 139 {
 140     int ret;
 141
 142     module_call_init(MODULE_INIT_QOM);
 143     g_test_init(&argc, &argv, NULL);
 144     g_setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
 145
 146     mkdir(WORKDIR, 0700);
 147
 148     test_tls_init(KEYFILE);
 149
 150 # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail)           \
 151     struct QCryptoTLSCredsTestData name = {                             \
 152         isServer, caCrt, crt, expectFail                                \
 153     };                                                                  \
 154     g_test_add_data_func("/qcrypto/tlscredsx509/" # name,               \
 155                          &name, test_tls_creds);                        \
 156
 157     /* A perfect CA, perfect client & perfect server */
 158
 159     /* Basic:CA:critical */
 160     TLS_ROOT_REQ(cacertreq,
 161                  "UK", "qemu CA", NULL, NULL, NULL, NULL,
 162                  true, true, true,
 163                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 164                  false, false, NULL, NULL,
 165                  0, 0);
 166
 167     TLS_CERT_REQ(servercertreq, cacertreq,
 168                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 169                  true, true, false,
 170                  true, true,
 171                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 172                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 173                  0, 0);
 174     TLS_CERT_REQ(clientcertreq, cacertreq,
 175                  "UK", "qemu", NULL, NULL, NULL, NULL,
 176                  true, true, false,
 177                  true, true,
 178                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 179                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 180                  0, 0);
 181
 182     TLS_TEST_REG(perfectserver, true,
 183                  cacertreq.filename, servercertreq.filename, false);
 184     TLS_TEST_REG(perfectclient, false,
 185                  cacertreq.filename, clientcertreq.filename, false);
 186
 187
 188     /* Some other CAs which are good */
 189
 190     /* Basic:CA:critical */
 191     TLS_ROOT_REQ(cacert1req,
 192                  "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
 193                  true, true, true,
 194                  false, false, 0,
 195                  false, false, NULL, NULL,
 196                  0, 0);
 197     TLS_CERT_REQ(servercert1req, cacert1req,
 198                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 199                  true, true, false,
 200                  true, true,
 201                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 202                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 203                  0, 0);
 204
 205     /* Basic:CA:not-critical */
 206     TLS_ROOT_REQ(cacert2req,
 207                  "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
 208                  true, false, true,
 209                  false, false, 0,
 210                  false, false, NULL, NULL,
 211                  0, 0);
 212     TLS_CERT_REQ(servercert2req, cacert2req,
 213                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 214                  true, true, false,
 215                  true, true,
 216                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 217                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 218                  0, 0);
 219
 220     /* Key usage:cert-sign:critical */
 221     TLS_ROOT_REQ(cacert3req,
 222                  "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
 223                  true, true, true,
 224                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 225                  false, false, NULL, NULL,
 226                  0, 0);
 227     TLS_CERT_REQ(servercert3req, cacert3req,
 228                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 229                  true, true, false,
 230                  true, true,
 231                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 232                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 233                  0, 0);
 234
 235     TLS_TEST_REG(goodca1, true,
 236                  cacert1req.filename, servercert1req.filename, false);
 237     TLS_TEST_REG(goodca2, true,
 238                  cacert2req.filename, servercert2req.filename, false);
 239     TLS_TEST_REG(goodca3, true,
 240                  cacert3req.filename, servercert3req.filename, false);
 241
 242     /* Now some bad certs */
 243
 244     /* Key usage:dig-sig:not-critical */
 245     TLS_ROOT_REQ(cacert4req,
 246                  "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
 247                  true, true, true,
 248                  true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
 249                  false, false, NULL, NULL,
 250                  0, 0);
 251     TLS_CERT_REQ(servercert4req, cacert4req,
 252                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 253                  true, true, false,
 254                  true, true,
 255                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 256                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 257                  0, 0);
 258     /* no-basic */
 259     TLS_ROOT_REQ(cacert5req,
 260                  "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
 261                  false, false, false,
 262                  false, false, 0,
 263                  false, false, NULL, NULL,
 264                  0, 0);
 265     TLS_CERT_REQ(servercert5req, cacert5req,
 266                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 267                  true, true, false,
 268                  true, true,
 269                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 270                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 271                  0, 0);
 272     /* Key usage:dig-sig:critical */
 273     TLS_ROOT_REQ(cacert6req,
 274                  "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
 275                  true, true, true,
 276                  true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
 277                  false, false, NULL, NULL,
 278                  0, 0);
 279     TLS_CERT_REQ(servercert6req, cacert6req,
 280                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 281                  true, true, false,
 282                  true, true,
 283                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 284                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 285                  0, 0);
 286
 287     TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
 288                  true);
 289     TLS_TEST_REG(badca2, true,
 290                  cacert5req.filename, servercert5req.filename, true);
 291     TLS_TEST_REG(badca3, true,
 292                  cacert6req.filename, servercert6req.filename, true);
 293
 294
 295     /* Various good servers */
 296     /* no usage or purpose */
 297     TLS_CERT_REQ(servercert7req, cacertreq,
 298                  "UK", "qemu", NULL, NULL, NULL, NULL,
 299                  true, true, false,
 300                  false, false, 0,
 301                  false, false, NULL, NULL,
 302                  0, 0);
 303     /* usage:cert-sign+dig-sig+encipher:critical */
 304     TLS_CERT_REQ(servercert8req, cacertreq,
 305                  "UK", "qemu", NULL, NULL, NULL, NULL,
 306                  true, true, false,
 307                  true, true,
 308                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 309                  GNUTLS_KEY_KEY_CERT_SIGN,
 310                  false, false, NULL, NULL,
 311                  0, 0);
 312     /* usage:cert-sign:not-critical */
 313     TLS_CERT_REQ(servercert9req, cacertreq,
 314                  "UK", "qemu", NULL, NULL, NULL, NULL,
 315                  true, true, false,
 316                  true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 317                  false, false, NULL, NULL,
 318                  0, 0);
 319     /* purpose:server:critical */
 320     TLS_CERT_REQ(servercert10req, cacertreq,
 321                  "UK", "qemu", NULL, NULL, NULL, NULL,
 322                  true, true, false,
 323                  false, false, 0,
 324                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 325                  0, 0);
 326     /* purpose:server:not-critical */
 327     TLS_CERT_REQ(servercert11req, cacertreq,
 328                  "UK", "qemu", NULL, NULL, NULL, NULL,
 329                  true, true, false,
 330                  false, false, 0,
 331                  true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 332                  0, 0);
 333     /* purpose:client+server:critical */
 334     TLS_CERT_REQ(servercert12req, cacertreq,
 335                  "UK", "qemu", NULL, NULL, NULL, NULL,
 336                  true, true, false,
 337                  false, false, 0,
 338                  true, true,
 339                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 340                  0, 0);
 341     /* purpose:client+server:not-critical */
 342     TLS_CERT_REQ(servercert13req, cacertreq,
 343                  "UK", "qemu", NULL, NULL, NULL, NULL,
 344                  true, true, false,
 345                  false, false, 0,
 346                  true, false,
 347                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 348                  0, 0);
 349
 350     TLS_TEST_REG(goodserver1, true,
 351                  cacertreq.filename, servercert7req.filename, false);
 352     TLS_TEST_REG(goodserver2, true,
 353                  cacertreq.filename, servercert8req.filename, false);
 354     TLS_TEST_REG(goodserver3, true,
 355                  cacertreq.filename, servercert9req.filename, false);
 356     TLS_TEST_REG(goodserver4, true,
 357                  cacertreq.filename, servercert10req.filename, false);
 358     TLS_TEST_REG(goodserver5, true,
 359                  cacertreq.filename, servercert11req.filename, false);
 360     TLS_TEST_REG(goodserver6, true,
 361                  cacertreq.filename, servercert12req.filename, false);
 362     TLS_TEST_REG(goodserver7, true,
 363                  cacertreq.filename, servercert13req.filename, false);
 364
 365     /* Bad servers */
 366
 367     /* usage:cert-sign:critical */
 368     TLS_CERT_REQ(servercert14req, cacertreq,
 369                  "UK", "qemu", NULL, NULL, NULL, NULL,
 370                  true, true, false,
 371                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 372                  false, false, NULL, NULL,
 373                  0, 0);
 374     /* purpose:client:critical */
 375     TLS_CERT_REQ(servercert15req, cacertreq,
 376                  "UK", "qemu", NULL, NULL, NULL, NULL,
 377                  true, true, false,
 378                  false, false, 0,
 379                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 380                  0, 0);
 381     /* usage: none:critical */
 382     TLS_CERT_REQ(servercert16req, cacertreq,
 383                  "UK", "qemu", NULL, NULL, NULL, NULL,
 384                  true, true, false,
 385                  true, true, 0,
 386                  false, false, NULL, NULL,
 387                  0, 0);
 388
 389     TLS_TEST_REG(badserver1, true,
 390                  cacertreq.filename, servercert14req.filename, true);
 391     TLS_TEST_REG(badserver2, true,
 392                  cacertreq.filename, servercert15req.filename, true);
 393     TLS_TEST_REG(badserver3, true,
 394                  cacertreq.filename, servercert16req.filename, true);
 395
 396
 397
 398     /* Various good clients */
 399     /* no usage or purpose */
 400     TLS_CERT_REQ(clientcert1req, cacertreq,
 401                  "UK", "qemu", NULL, NULL, NULL, NULL,
 402                  true, true, false,
 403                  false, false, 0,
 404                  false, false, NULL, NULL,
 405                  0, 0);
 406     /* usage:cert-sign+dig-sig+encipher:critical */
 407     TLS_CERT_REQ(clientcert2req, cacertreq,
 408                  "UK", "qemu", NULL, NULL, NULL, NULL,
 409                  true, true, false,
 410                  true, true,
 411                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 412                  GNUTLS_KEY_KEY_CERT_SIGN,
 413                  false, false, NULL, NULL,
 414                  0, 0);
 415     /* usage:cert-sign:not-critical */
 416     TLS_CERT_REQ(clientcert3req, cacertreq,
 417                  "UK", "qemu", NULL, NULL, NULL, NULL,
 418                  true, true, false,
 419                  true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 420                  false, false, NULL, NULL,
 421                  0, 0);
 422     /* purpose:client:critical */
 423     TLS_CERT_REQ(clientcert4req, cacertreq,
 424                  "UK", "qemu", NULL, NULL, NULL, NULL,
 425                  true, true, false,
 426                  false, false, 0,
 427                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 428                  0, 0);
 429     /* purpose:client:not-critical */
 430     TLS_CERT_REQ(clientcert5req, cacertreq,
 431                  "UK", "qemu", NULL, NULL, NULL, NULL,
 432                  true, true, false,
 433                  false, false, 0,
 434                  true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 435                  0, 0);
 436     /* purpose:client+client:critical */
 437     TLS_CERT_REQ(clientcert6req, cacertreq,
 438                  "UK", "qemu", NULL, NULL, NULL, NULL,
 439                  true, true, false,
 440                  false, false, 0,
 441                  true, true,
 442                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 443                  0, 0);
 444     /* purpose:client+client:not-critical */
 445     TLS_CERT_REQ(clientcert7req, cacertreq,
 446                  "UK", "qemu", NULL, NULL, NULL, NULL,
 447                  true, true, false,
 448                  false, false, 0,
 449                  true, false,
 450                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 451                  0, 0);
 452
 453     TLS_TEST_REG(goodclient1, false,
 454                  cacertreq.filename, clientcert1req.filename, false);
 455     TLS_TEST_REG(goodclient2, false,
 456                  cacertreq.filename, clientcert2req.filename, false);
 457     TLS_TEST_REG(goodclient3, false,
 458                  cacertreq.filename, clientcert3req.filename, false);
 459     TLS_TEST_REG(goodclient4, false,
 460                  cacertreq.filename, clientcert4req.filename, false);
 461     TLS_TEST_REG(goodclient5, false,
 462                  cacertreq.filename, clientcert5req.filename, false);
 463     TLS_TEST_REG(goodclient6, false,
 464                  cacertreq.filename, clientcert6req.filename, false);
 465     TLS_TEST_REG(goodclient7, false,
 466                  cacertreq.filename, clientcert7req.filename, false);
 467
 468     /* Bad clients */
 469
 470     /* usage:cert-sign:critical */
 471     TLS_CERT_REQ(clientcert8req, cacertreq,
 472                  "UK", "qemu", NULL, NULL, NULL, NULL,
 473                  true, true, false,
 474                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 475                  false, false, NULL, NULL,
 476                  0, 0);
 477     /* purpose:client:critical */
 478     TLS_CERT_REQ(clientcert9req, cacertreq,
 479                  "UK", "qemu", NULL, NULL, NULL, NULL,
 480                  true, true, false,
 481                  false, false, 0,
 482                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 483                  0, 0);
 484     /* usage: none:critical */
 485     TLS_CERT_REQ(clientcert10req, cacertreq,
 486                  "UK", "qemu", NULL, NULL, NULL, NULL,
 487                  true, true, false,
 488                  true, true, 0,
 489                  false, false, NULL, NULL,
 490                  0, 0);
 491
 492     TLS_TEST_REG(badclient1, false,
 493                  cacertreq.filename, clientcert8req.filename, true);
 494     TLS_TEST_REG(badclient2, false,
 495                  cacertreq.filename, clientcert9req.filename, true);
 496     TLS_TEST_REG(badclient3, false,
 497                  cacertreq.filename, clientcert10req.filename, true);
 498
 499
 500
 501     /* Expired stuff */
 502
 503     TLS_ROOT_REQ(cacertexpreq,
 504                  "UK", "qemu", NULL, NULL, NULL, NULL,
 505                  true, true, true,
 506                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 507                  false, false, NULL, NULL,
 508                  0, -1);
 509     TLS_CERT_REQ(servercertexpreq, cacertexpreq,
 510                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 511                  true, true, false,
 512                  true, true,
 513                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 514                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 515                  0, 0);
 516     TLS_CERT_REQ(servercertexp1req, cacertreq,
 517                  "UK", "qemu", NULL, NULL, NULL, NULL,
 518                  true, true, false,
 519                  true, true,
 520                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 521                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 522                  0, -1);
 523     TLS_CERT_REQ(clientcertexp1req, cacertreq,
 524                  "UK", "qemu", NULL, NULL, NULL, NULL,
 525                  true, true, false,
 526                  true, true,
 527                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 528                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 529                  0, -1);
 530
 531     TLS_TEST_REG(expired1, true,
 532                  cacertexpreq.filename, servercertexpreq.filename, true);
 533     TLS_TEST_REG(expired2, true,
 534                  cacertreq.filename, servercertexp1req.filename, true);
 535     TLS_TEST_REG(expired3, false,
 536                  cacertreq.filename, clientcertexp1req.filename, true);
 537
 538
 539     /* Not activated stuff */
 540
 541     TLS_ROOT_REQ(cacertnewreq,
 542                  "UK", "qemu", NULL, NULL, NULL, NULL,
 543                  true, true, true,
 544                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 545                  false, false, NULL, NULL,
 546                  1, 2);
 547     TLS_CERT_REQ(servercertnewreq, cacertnewreq,
 548                  "UK", "qemu", NULL, NULL, NULL, NULL,
 549                  true, true, false,
 550                  true, true,
 551                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 552                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 553                  0, 0);
 554     TLS_CERT_REQ(servercertnew1req, cacertreq,
 555                  "UK", "qemu", NULL, NULL, NULL, NULL,
 556                  true, true, false,
 557                  true, true,
 558                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 559                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 560                  1, 2);
 561     TLS_CERT_REQ(clientcertnew1req, cacertreq,
 562                  "UK", "qemu", NULL, NULL, NULL, NULL,
 563                  true, true, false,
 564                  true, true,
 565                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 566                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 567                  1, 2);
 568
 569     TLS_TEST_REG(inactive1, true,
 570                  cacertnewreq.filename, servercertnewreq.filename, true);
 571     TLS_TEST_REG(inactive2, true,
 572                  cacertreq.filename, servercertnew1req.filename, true);
 573     TLS_TEST_REG(inactive3, false,
 574                  cacertreq.filename, clientcertnew1req.filename, true);
 575
 576     TLS_ROOT_REQ(cacertrootreq,
 577                  "UK", "qemu root", NULL, NULL, NULL, NULL,
 578                  true, true, true,
 579                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 580                  false, false, NULL, NULL,
 581                  0, 0);
 582     TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
 583                  "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
 584                  true, true, true,
 585                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 586                  false, false, NULL, NULL,
 587                  0, 0);
 588     TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
 589                  "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
 590                  true, true, true,
 591                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 592                  false, false, NULL, NULL,
 593                  0, 0);
 594     TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
 595                  "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
 596                  true, true, true,
 597                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 598                  false, false, NULL, NULL,
 599                  0, 0);
 600     TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
 601                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 602                  true, true, false,
 603                  true, true,
 604                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 605                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 606                  0, 0);
 607     TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
 608                  "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
 609                  true, true, false,
 610                  true, true,
 611                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 612                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 613                  0, 0);
 614
 615     gnutls_x509_crt_t certchain[] = {
 616         cacertrootreq.crt,
 617         cacertlevel1areq.crt,
 618         cacertlevel1breq.crt,
 619         cacertlevel2areq.crt,
 620     };
 621
 622     test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
 623                               certchain,
 624                               G_N_ELEMENTS(certchain));
 625
 626     TLS_TEST_REG(chain1, true,
 627                  WORKDIR "cacertchain-ctx.pem",
 628                  servercertlevel3areq.filename, false);
 629     TLS_TEST_REG(chain2, false,
 630                  WORKDIR "cacertchain-ctx.pem",
 631                  clientcertlevel2breq.filename, false);
 632
 633     /* Some missing certs - first two are fatal, the last
 634      * is ok
 635      */
 636     TLS_TEST_REG(missingca, true,
 637                  "cacertdoesnotexist.pem",
 638                  servercert1req.filename, true);
 639     TLS_TEST_REG(missingserver, true,
 640                  cacert1req.filename,
 641                  "servercertdoesnotexist.pem", true);
 642     TLS_TEST_REG(missingclient, false,
 643                  cacert1req.filename,
 644                  "clientcertdoesnotexist.pem", false);
 645
 646     ret = g_test_run();
 647
 648     test_tls_discard_cert(&cacertreq);
 649     test_tls_discard_cert(&cacert1req);
 650     test_tls_discard_cert(&cacert2req);
 651     test_tls_discard_cert(&cacert3req);
 652     test_tls_discard_cert(&cacert4req);
 653     test_tls_discard_cert(&cacert5req);
 654     test_tls_discard_cert(&cacert6req);
 655
 656     test_tls_discard_cert(&servercertreq);
 657     test_tls_discard_cert(&servercert1req);
 658     test_tls_discard_cert(&servercert2req);
 659     test_tls_discard_cert(&servercert3req);
 660     test_tls_discard_cert(&servercert4req);
 661     test_tls_discard_cert(&servercert5req);
 662     test_tls_discard_cert(&servercert6req);
 663     test_tls_discard_cert(&servercert7req);
 664     test_tls_discard_cert(&servercert8req);
 665     test_tls_discard_cert(&servercert9req);
 666     test_tls_discard_cert(&servercert10req);
 667     test_tls_discard_cert(&servercert11req);
 668     test_tls_discard_cert(&servercert12req);
 669     test_tls_discard_cert(&servercert13req);
 670     test_tls_discard_cert(&servercert14req);
 671     test_tls_discard_cert(&servercert15req);
 672     test_tls_discard_cert(&servercert16req);
 673
 674     test_tls_discard_cert(&clientcertreq);
 675     test_tls_discard_cert(&clientcert1req);
 676     test_tls_discard_cert(&clientcert2req);
 677     test_tls_discard_cert(&clientcert3req);
 678     test_tls_discard_cert(&clientcert4req);
 679     test_tls_discard_cert(&clientcert5req);
 680     test_tls_discard_cert(&clientcert6req);
 681     test_tls_discard_cert(&clientcert7req);
 682     test_tls_discard_cert(&clientcert8req);
 683     test_tls_discard_cert(&clientcert9req);
 684     test_tls_discard_cert(&clientcert10req);
 685
 686     test_tls_discard_cert(&cacertexpreq);
 687     test_tls_discard_cert(&servercertexpreq);
 688     test_tls_discard_cert(&servercertexp1req);
 689     test_tls_discard_cert(&clientcertexp1req);
 690
 691     test_tls_discard_cert(&cacertnewreq);
 692     test_tls_discard_cert(&servercertnewreq);
 693     test_tls_discard_cert(&servercertnew1req);
 694     test_tls_discard_cert(&clientcertnew1req);
 695
 696     test_tls_discard_cert(&cacertrootreq);
 697     test_tls_discard_cert(&cacertlevel1areq);
 698     test_tls_discard_cert(&cacertlevel1breq);
 699     test_tls_discard_cert(&cacertlevel2areq);
 700     test_tls_discard_cert(&servercertlevel3areq);
 701     test_tls_discard_cert(&clientcertlevel2breq);
 702     unlink(WORKDIR "cacertchain-ctx.pem");
 703
 704     test_tls_cleanup(KEYFILE);
 705     rmdir(WORKDIR);
 706
 707     return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 708 }
 709
 710 #else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 711
 712 int
 713 main(void)
 714 {
 715     return EXIT_SUCCESS;
 716 }
 717
 718 #endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */