tests/test-crypto-tlscredsx509.c

   1 /*
   2  * Copyright (C) 2015 Red Hat, Inc.
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library.  If not, see
  16  * <http://www.gnu.org/licenses/>.
  17  *
  18  * Author: Daniel P. Berrange <berrange@redhat.com>
  19  */
  20
  21 #include <stdlib.h>
  22 #include <fcntl.h>
  23
  24 #include "config-host.h"
  25 #include "crypto-tls-x509-helpers.h"
  26 #include "crypto/tlscredsx509.h"
  27
  28 #ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
  29
  30 #define WORKDIR "tests/test-crypto-tlscredsx509-work/"
  31 #define KEYFILE WORKDIR "key-ctx.pem"
  32
  33 struct QCryptoTLSCredsTestData {
  34     bool isServer;
  35     const char *cacrt;
  36     const char *crt;
  37     bool expectFail;
  38 };
  39
  40
  41 static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
  42                                               const char *certdir,
  43                                               Error **errp)
  44 {
  45     Object *parent = object_get_objects_root();
  46     Object *creds = object_new_with_props(
  47         TYPE_QCRYPTO_TLS_CREDS_X509,
  48         parent,
  49         "testtlscreds",
  50         errp,
  51         "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
  52                      "server" : "client"),
  53         "dir", certdir,
  54         "verify-peer", "yes",
  55         "sanity-check", "yes",
  56         NULL);
  57
  58     if (*errp) {
  59         return NULL;
  60     }
  61     return QCRYPTO_TLS_CREDS(creds);
  62 }
  63
  64 /*
  65  * This tests sanity checking of our own certificates
  66  *
  67  * The code being tested is used when TLS creds are created,
  68  * and aim to ensure QMEU has been configured with sane
  69  * certificates. This allows us to give much much much
  70  * clearer error messages to the admin when they misconfigure
  71  * things.
  72  */
  73 static void test_tls_creds(const void *opaque)
  74 {
  75     struct QCryptoTLSCredsTestData *data =
  76         (struct QCryptoTLSCredsTestData *)opaque;
  77     QCryptoTLSCreds *creds;
  78     Error *err = NULL;
  79
  80 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
  81     mkdir(CERT_DIR, 0700);
  82
  83     unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
  84     if (data->isServer) {
  85         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
  86         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
  87     } else {
  88         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
  89         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
  90     }
  91
  92     if (access(data->cacrt, R_OK) == 0) {
  93         g_assert(link(data->cacrt,
  94                       CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
  95     }
  96     if (data->isServer) {
  97         if (access(data->crt, R_OK) == 0) {
  98             g_assert(link(data->crt,
  99                           CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
 100         }
 101         g_assert(link(KEYFILE,
 102                       CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
 103     } else {
 104         if (access(data->crt, R_OK) == 0) {
 105             g_assert(link(data->crt,
 106                           CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
 107         }
 108         g_assert(link(KEYFILE,
 109                       CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
 110     }
 111
 112     creds = test_tls_creds_create(
 113         (data->isServer ?
 114          QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
 115          QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
 116         CERT_DIR,
 117         &err);
 118
 119     if (data->expectFail) {
 120         error_free(err);
 121         g_assert(creds == NULL);
 122     } else {
 123         if (err) {
 124             g_printerr("Failed to generate creds: %s\n",
 125                        error_get_pretty(err));
 126             error_free(err);
 127         }
 128         g_assert(creds != NULL);
 129     }
 130
 131     unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
 132     if (data->isServer) {
 133         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
 134         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
 135     } else {
 136         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
 137         unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
 138     }
 139     rmdir(CERT_DIR);
 140     if (creds) {
 141         object_unparent(OBJECT(creds));
 142     }
 143 }
 144
 145 int main(int argc, char **argv)
 146 {
 147     int ret;
 148
 149     module_call_init(MODULE_INIT_QOM);
 150     g_test_init(&argc, &argv, NULL);
 151     setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
 152
 153     mkdir(WORKDIR, 0700);
 154
 155     test_tls_init(KEYFILE);
 156
 157 # define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail)           \
 158     struct QCryptoTLSCredsTestData name = {                             \
 159         isServer, caCrt, crt, expectFail                                \
 160     };                                                                  \
 161     g_test_add_data_func("/qcrypto/tlscredsx509/" # name,               \
 162                          &name, test_tls_creds);                        \
 163
 164     /* A perfect CA, perfect client & perfect server */
 165
 166     /* Basic:CA:critical */
 167     TLS_ROOT_REQ(cacertreq,
 168                  "UK", "qemu CA", NULL, NULL, NULL, NULL,
 169                  true, true, true,
 170                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 171                  false, false, NULL, NULL,
 172                  0, 0);
 173
 174     TLS_CERT_REQ(servercertreq, cacertreq,
 175                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 176                  true, true, false,
 177                  true, true,
 178                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 179                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 180                  0, 0);
 181     TLS_CERT_REQ(clientcertreq, cacertreq,
 182                  "UK", "qemu", NULL, NULL, NULL, NULL,
 183                  true, true, false,
 184                  true, true,
 185                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 186                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 187                  0, 0);
 188
 189     TLS_TEST_REG(perfectserver, true,
 190                  cacertreq.filename, servercertreq.filename, false);
 191     TLS_TEST_REG(perfectclient, false,
 192                  cacertreq.filename, clientcertreq.filename, false);
 193
 194
 195     /* Some other CAs which are good */
 196
 197     /* Basic:CA:critical */
 198     TLS_ROOT_REQ(cacert1req,
 199                  "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
 200                  true, true, true,
 201                  false, false, 0,
 202                  false, false, NULL, NULL,
 203                  0, 0);
 204     TLS_CERT_REQ(servercert1req, cacert1req,
 205                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 206                  true, true, false,
 207                  true, true,
 208                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 209                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 210                  0, 0);
 211
 212     /* Basic:CA:not-critical */
 213     TLS_ROOT_REQ(cacert2req,
 214                  "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
 215                  true, false, true,
 216                  false, false, 0,
 217                  false, false, NULL, NULL,
 218                  0, 0);
 219     TLS_CERT_REQ(servercert2req, cacert2req,
 220                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 221                  true, true, false,
 222                  true, true,
 223                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 224                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 225                  0, 0);
 226
 227     /* Key usage:cert-sign:critical */
 228     TLS_ROOT_REQ(cacert3req,
 229                  "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
 230                  true, true, true,
 231                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 232                  false, false, NULL, NULL,
 233                  0, 0);
 234     TLS_CERT_REQ(servercert3req, cacert3req,
 235                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 236                  true, true, false,
 237                  true, true,
 238                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 239                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 240                  0, 0);
 241
 242     TLS_TEST_REG(goodca1, true,
 243                  cacert1req.filename, servercert1req.filename, false);
 244     TLS_TEST_REG(goodca2, true,
 245                  cacert2req.filename, servercert2req.filename, false);
 246     TLS_TEST_REG(goodca3, true,
 247                  cacert3req.filename, servercert3req.filename, false);
 248
 249     /* Now some bad certs */
 250
 251     /* Key usage:dig-sig:not-critical */
 252     TLS_ROOT_REQ(cacert4req,
 253                  "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
 254                  true, true, true,
 255                  true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
 256                  false, false, NULL, NULL,
 257                  0, 0);
 258     TLS_CERT_REQ(servercert4req, cacert4req,
 259                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 260                  true, true, false,
 261                  true, true,
 262                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 263                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 264                  0, 0);
 265     /* no-basic */
 266     TLS_ROOT_REQ(cacert5req,
 267                  "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
 268                  false, false, false,
 269                  false, false, 0,
 270                  false, false, NULL, NULL,
 271                  0, 0);
 272     TLS_CERT_REQ(servercert5req, cacert5req,
 273                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 274                  true, true, false,
 275                  true, true,
 276                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 277                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 278                  0, 0);
 279     /* Key usage:dig-sig:critical */
 280     TLS_ROOT_REQ(cacert6req,
 281                  "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
 282                  true, true, true,
 283                  true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
 284                  false, false, NULL, NULL,
 285                  0, 0);
 286     TLS_CERT_REQ(servercert6req, cacert6req,
 287                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 288                  true, true, false,
 289                  true, true,
 290                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 291                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 292                  0, 0);
 293
 294     /* Technically a CA cert with basic constraints
 295      * key purpose == key signing + non-critical should
 296      * be rejected. GNUTLS < 3.1 does not reject it and
 297      * we don't anticipate them changing this behaviour
 298      */
 299     TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
 300                 (GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) ||
 301                 GNUTLS_VERSION_MAJOR > 3);
 302     TLS_TEST_REG(badca2, true,
 303                  cacert5req.filename, servercert5req.filename, true);
 304     TLS_TEST_REG(badca3, true,
 305                  cacert6req.filename, servercert6req.filename, true);
 306
 307
 308     /* Various good servers */
 309     /* no usage or purpose */
 310     TLS_CERT_REQ(servercert7req, cacertreq,
 311                  "UK", "qemu", NULL, NULL, NULL, NULL,
 312                  true, true, false,
 313                  false, false, 0,
 314                  false, false, NULL, NULL,
 315                  0, 0);
 316     /* usage:cert-sign+dig-sig+encipher:critical */
 317     TLS_CERT_REQ(servercert8req, cacertreq,
 318                  "UK", "qemu", NULL, NULL, NULL, NULL,
 319                  true, true, false,
 320                  true, true,
 321                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 322                  GNUTLS_KEY_KEY_CERT_SIGN,
 323                  false, false, NULL, NULL,
 324                  0, 0);
 325     /* usage:cert-sign:not-critical */
 326     TLS_CERT_REQ(servercert9req, cacertreq,
 327                  "UK", "qemu", NULL, NULL, NULL, NULL,
 328                  true, true, false,
 329                  true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 330                  false, false, NULL, NULL,
 331                  0, 0);
 332     /* purpose:server:critical */
 333     TLS_CERT_REQ(servercert10req, cacertreq,
 334                  "UK", "qemu", NULL, NULL, NULL, NULL,
 335                  true, true, false,
 336                  false, false, 0,
 337                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 338                  0, 0);
 339     /* purpose:server:not-critical */
 340     TLS_CERT_REQ(servercert11req, cacertreq,
 341                  "UK", "qemu", NULL, NULL, NULL, NULL,
 342                  true, true, false,
 343                  false, false, 0,
 344                  true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 345                  0, 0);
 346     /* purpose:client+server:critical */
 347     TLS_CERT_REQ(servercert12req, cacertreq,
 348                  "UK", "qemu", NULL, NULL, NULL, NULL,
 349                  true, true, false,
 350                  false, false, 0,
 351                  true, true,
 352                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 353                  0, 0);
 354     /* purpose:client+server:not-critical */
 355     TLS_CERT_REQ(servercert13req, cacertreq,
 356                  "UK", "qemu", NULL, NULL, NULL, NULL,
 357                  true, true, false,
 358                  false, false, 0,
 359                  true, false,
 360                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 361                  0, 0);
 362
 363     TLS_TEST_REG(goodserver1, true,
 364                  cacertreq.filename, servercert7req.filename, false);
 365     TLS_TEST_REG(goodserver2, true,
 366                  cacertreq.filename, servercert8req.filename, false);
 367     TLS_TEST_REG(goodserver3, true,
 368                  cacertreq.filename, servercert9req.filename, false);
 369     TLS_TEST_REG(goodserver4, true,
 370                  cacertreq.filename, servercert10req.filename, false);
 371     TLS_TEST_REG(goodserver5, true,
 372                  cacertreq.filename, servercert11req.filename, false);
 373     TLS_TEST_REG(goodserver6, true,
 374                  cacertreq.filename, servercert12req.filename, false);
 375     TLS_TEST_REG(goodserver7, true,
 376                  cacertreq.filename, servercert13req.filename, false);
 377
 378     /* Bad servers */
 379
 380     /* usage:cert-sign:critical */
 381     TLS_CERT_REQ(servercert14req, cacertreq,
 382                  "UK", "qemu", NULL, NULL, NULL, NULL,
 383                  true, true, false,
 384                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 385                  false, false, NULL, NULL,
 386                  0, 0);
 387     /* purpose:client:critical */
 388     TLS_CERT_REQ(servercert15req, cacertreq,
 389                  "UK", "qemu", NULL, NULL, NULL, NULL,
 390                  true, true, false,
 391                  false, false, 0,
 392                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 393                  0, 0);
 394     /* usage: none:critical */
 395     TLS_CERT_REQ(servercert16req, cacertreq,
 396                  "UK", "qemu", NULL, NULL, NULL, NULL,
 397                  true, true, false,
 398                  true, true, 0,
 399                  false, false, NULL, NULL,
 400                  0, 0);
 401
 402     TLS_TEST_REG(badserver1, true,
 403                  cacertreq.filename, servercert14req.filename, true);
 404     TLS_TEST_REG(badserver2, true,
 405                  cacertreq.filename, servercert15req.filename, true);
 406     TLS_TEST_REG(badserver3, true,
 407                  cacertreq.filename, servercert16req.filename, true);
 408
 409
 410
 411     /* Various good clients */
 412     /* no usage or purpose */
 413     TLS_CERT_REQ(clientcert1req, cacertreq,
 414                  "UK", "qemu", NULL, NULL, NULL, NULL,
 415                  true, true, false,
 416                  false, false, 0,
 417                  false, false, NULL, NULL,
 418                  0, 0);
 419     /* usage:cert-sign+dig-sig+encipher:critical */
 420     TLS_CERT_REQ(clientcert2req, cacertreq,
 421                  "UK", "qemu", NULL, NULL, NULL, NULL,
 422                  true, true, false,
 423                  true, true,
 424                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 425                  GNUTLS_KEY_KEY_CERT_SIGN,
 426                  false, false, NULL, NULL,
 427                  0, 0);
 428     /* usage:cert-sign:not-critical */
 429     TLS_CERT_REQ(clientcert3req, cacertreq,
 430                  "UK", "qemu", NULL, NULL, NULL, NULL,
 431                  true, true, false,
 432                  true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 433                  false, false, NULL, NULL,
 434                  0, 0);
 435     /* purpose:client:critical */
 436     TLS_CERT_REQ(clientcert4req, cacertreq,
 437                  "UK", "qemu", NULL, NULL, NULL, NULL,
 438                  true, true, false,
 439                  false, false, 0,
 440                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 441                  0, 0);
 442     /* purpose:client:not-critical */
 443     TLS_CERT_REQ(clientcert5req, cacertreq,
 444                  "UK", "qemu", NULL, NULL, NULL, NULL,
 445                  true, true, false,
 446                  false, false, 0,
 447                  true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 448                  0, 0);
 449     /* purpose:client+client:critical */
 450     TLS_CERT_REQ(clientcert6req, cacertreq,
 451                  "UK", "qemu", NULL, NULL, NULL, NULL,
 452                  true, true, false,
 453                  false, false, 0,
 454                  true, true,
 455                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 456                  0, 0);
 457     /* purpose:client+client:not-critical */
 458     TLS_CERT_REQ(clientcert7req, cacertreq,
 459                  "UK", "qemu", NULL, NULL, NULL, NULL,
 460                  true, true, false,
 461                  false, false, 0,
 462                  true, false,
 463                  GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 464                  0, 0);
 465
 466     TLS_TEST_REG(goodclient1, false,
 467                  cacertreq.filename, clientcert1req.filename, false);
 468     TLS_TEST_REG(goodclient2, false,
 469                  cacertreq.filename, clientcert2req.filename, false);
 470     TLS_TEST_REG(goodclient3, false,
 471                  cacertreq.filename, clientcert3req.filename, false);
 472     TLS_TEST_REG(goodclient4, false,
 473                  cacertreq.filename, clientcert4req.filename, false);
 474     TLS_TEST_REG(goodclient5, false,
 475                  cacertreq.filename, clientcert5req.filename, false);
 476     TLS_TEST_REG(goodclient6, false,
 477                  cacertreq.filename, clientcert6req.filename, false);
 478     TLS_TEST_REG(goodclient7, false,
 479                  cacertreq.filename, clientcert7req.filename, false);
 480
 481     /* Bad clients */
 482
 483     /* usage:cert-sign:critical */
 484     TLS_CERT_REQ(clientcert8req, cacertreq,
 485                  "UK", "qemu", NULL, NULL, NULL, NULL,
 486                  true, true, false,
 487                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 488                  false, false, NULL, NULL,
 489                  0, 0);
 490     /* purpose:client:critical */
 491     TLS_CERT_REQ(clientcert9req, cacertreq,
 492                  "UK", "qemu", NULL, NULL, NULL, NULL,
 493                  true, true, false,
 494                  false, false, 0,
 495                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 496                  0, 0);
 497     /* usage: none:critical */
 498     TLS_CERT_REQ(clientcert10req, cacertreq,
 499                  "UK", "qemu", NULL, NULL, NULL, NULL,
 500                  true, true, false,
 501                  true, true, 0,
 502                  false, false, NULL, NULL,
 503                  0, 0);
 504
 505     TLS_TEST_REG(badclient1, false,
 506                  cacertreq.filename, clientcert8req.filename, true);
 507     TLS_TEST_REG(badclient2, false,
 508                  cacertreq.filename, clientcert9req.filename, true);
 509     TLS_TEST_REG(badclient3, false,
 510                  cacertreq.filename, clientcert10req.filename, true);
 511
 512
 513
 514     /* Expired stuff */
 515
 516     TLS_ROOT_REQ(cacertexpreq,
 517                  "UK", "qemu", NULL, NULL, NULL, NULL,
 518                  true, true, true,
 519                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 520                  false, false, NULL, NULL,
 521                  0, -1);
 522     TLS_CERT_REQ(servercertexpreq, cacertexpreq,
 523                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 524                  true, true, false,
 525                  true, true,
 526                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 527                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 528                  0, 0);
 529     TLS_CERT_REQ(servercertexp1req, cacertreq,
 530                  "UK", "qemu", NULL, NULL, NULL, NULL,
 531                  true, true, false,
 532                  true, true,
 533                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 534                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 535                  0, -1);
 536     TLS_CERT_REQ(clientcertexp1req, cacertreq,
 537                  "UK", "qemu", NULL, NULL, NULL, NULL,
 538                  true, true, false,
 539                  true, true,
 540                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 541                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 542                  0, -1);
 543
 544     TLS_TEST_REG(expired1, true,
 545                  cacertexpreq.filename, servercertexpreq.filename, true);
 546     TLS_TEST_REG(expired2, true,
 547                  cacertreq.filename, servercertexp1req.filename, true);
 548     TLS_TEST_REG(expired3, false,
 549                  cacertreq.filename, clientcertexp1req.filename, true);
 550
 551
 552     /* Not activated stuff */
 553
 554     TLS_ROOT_REQ(cacertnewreq,
 555                  "UK", "qemu", NULL, NULL, NULL, NULL,
 556                  true, true, true,
 557                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 558                  false, false, NULL, NULL,
 559                  1, 2);
 560     TLS_CERT_REQ(servercertnewreq, cacertnewreq,
 561                  "UK", "qemu", NULL, NULL, NULL, NULL,
 562                  true, true, false,
 563                  true, true,
 564                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 565                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 566                  0, 0);
 567     TLS_CERT_REQ(servercertnew1req, cacertreq,
 568                  "UK", "qemu", NULL, NULL, NULL, NULL,
 569                  true, true, false,
 570                  true, true,
 571                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 572                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 573                  1, 2);
 574     TLS_CERT_REQ(clientcertnew1req, cacertreq,
 575                  "UK", "qemu", NULL, NULL, NULL, NULL,
 576                  true, true, false,
 577                  true, true,
 578                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 579                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 580                  1, 2);
 581
 582     TLS_TEST_REG(inactive1, true,
 583                  cacertnewreq.filename, servercertnewreq.filename, true);
 584     TLS_TEST_REG(inactive2, true,
 585                  cacertreq.filename, servercertnew1req.filename, true);
 586     TLS_TEST_REG(inactive3, false,
 587                  cacertreq.filename, clientcertnew1req.filename, true);
 588
 589     TLS_ROOT_REQ(cacertrootreq,
 590                  "UK", "qemu root", NULL, NULL, NULL, NULL,
 591                  true, true, true,
 592                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 593                  false, false, NULL, NULL,
 594                  0, 0);
 595     TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
 596                  "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
 597                  true, true, true,
 598                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 599                  false, false, NULL, NULL,
 600                  0, 0);
 601     TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
 602                  "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
 603                  true, true, true,
 604                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 605                  false, false, NULL, NULL,
 606                  0, 0);
 607     TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
 608                  "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
 609                  true, true, true,
 610                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 611                  false, false, NULL, NULL,
 612                  0, 0);
 613     TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
 614                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
 615                  true, true, false,
 616                  true, true,
 617                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 618                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 619                  0, 0);
 620     TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
 621                  "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
 622                  true, true, false,
 623                  true, true,
 624                  GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 625                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 626                  0, 0);
 627
 628     gnutls_x509_crt_t certchain[] = {
 629         cacertrootreq.crt,
 630         cacertlevel1areq.crt,
 631         cacertlevel1breq.crt,
 632         cacertlevel2areq.crt,
 633     };
 634
 635     test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
 636                               certchain,
 637                               G_N_ELEMENTS(certchain));
 638
 639     TLS_TEST_REG(chain1, true,
 640                  WORKDIR "cacertchain-ctx.pem",
 641                  servercertlevel3areq.filename, false);
 642     TLS_TEST_REG(chain2, false,
 643                  WORKDIR "cacertchain-ctx.pem",
 644                  clientcertlevel2breq.filename, false);
 645
 646     /* Some missing certs - first two are fatal, the last
 647      * is ok
 648      */
 649     TLS_TEST_REG(missingca, true,
 650                  "cacertdoesnotexist.pem",
 651                  servercert1req.filename, true);
 652     TLS_TEST_REG(missingserver, true,
 653                  cacert1req.filename,
 654                  "servercertdoesnotexist.pem", true);
 655     TLS_TEST_REG(missingclient, false,
 656                  cacert1req.filename,
 657                  "clientcertdoesnotexist.pem", false);
 658
 659     ret = g_test_run();
 660
 661     test_tls_discard_cert(&cacertreq);
 662     test_tls_discard_cert(&cacert1req);
 663     test_tls_discard_cert(&cacert2req);
 664     test_tls_discard_cert(&cacert3req);
 665     test_tls_discard_cert(&cacert4req);
 666     test_tls_discard_cert(&cacert5req);
 667     test_tls_discard_cert(&cacert6req);
 668
 669     test_tls_discard_cert(&servercertreq);
 670     test_tls_discard_cert(&servercert1req);
 671     test_tls_discard_cert(&servercert2req);
 672     test_tls_discard_cert(&servercert3req);
 673     test_tls_discard_cert(&servercert4req);
 674     test_tls_discard_cert(&servercert5req);
 675     test_tls_discard_cert(&servercert6req);
 676     test_tls_discard_cert(&servercert7req);
 677     test_tls_discard_cert(&servercert8req);
 678     test_tls_discard_cert(&servercert9req);
 679     test_tls_discard_cert(&servercert10req);
 680     test_tls_discard_cert(&servercert11req);
 681     test_tls_discard_cert(&servercert12req);
 682     test_tls_discard_cert(&servercert13req);
 683     test_tls_discard_cert(&servercert14req);
 684     test_tls_discard_cert(&servercert15req);
 685     test_tls_discard_cert(&servercert16req);
 686
 687     test_tls_discard_cert(&clientcertreq);
 688     test_tls_discard_cert(&clientcert1req);
 689     test_tls_discard_cert(&clientcert2req);
 690     test_tls_discard_cert(&clientcert3req);
 691     test_tls_discard_cert(&clientcert4req);
 692     test_tls_discard_cert(&clientcert5req);
 693     test_tls_discard_cert(&clientcert6req);
 694     test_tls_discard_cert(&clientcert7req);
 695     test_tls_discard_cert(&clientcert8req);
 696     test_tls_discard_cert(&clientcert9req);
 697     test_tls_discard_cert(&clientcert10req);
 698
 699     test_tls_discard_cert(&cacertexpreq);
 700     test_tls_discard_cert(&servercertexpreq);
 701     test_tls_discard_cert(&servercertexp1req);
 702     test_tls_discard_cert(&clientcertexp1req);
 703
 704     test_tls_discard_cert(&cacertnewreq);
 705     test_tls_discard_cert(&servercertnewreq);
 706     test_tls_discard_cert(&servercertnew1req);
 707     test_tls_discard_cert(&clientcertnew1req);
 708
 709     test_tls_discard_cert(&cacertrootreq);
 710     test_tls_discard_cert(&cacertlevel1areq);
 711     test_tls_discard_cert(&cacertlevel1breq);
 712     test_tls_discard_cert(&cacertlevel2areq);
 713     test_tls_discard_cert(&servercertlevel3areq);
 714     test_tls_discard_cert(&clientcertlevel2breq);
 715     unlink(WORKDIR "cacertchain-ctx.pem");
 716
 717     test_tls_cleanup(KEYFILE);
 718     rmdir(WORKDIR);
 719
 720     return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 721 }
 722
 723 #else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 724
 725 int
 726 main(void)
 727 {
 728     return EXIT_SUCCESS;
 729 }
 730
 731 #endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */