LXR qemu/tests/test-crypto-tlscredsx509.c

   1/*
   2 * Copyright (C) 2015 Red Hat, Inc.
   3 *
   4 * This library is free software; you can redistribute it and/or
   5 * modify it under the terms of the GNU Lesser General Public
   6 * License as published by the Free Software Foundation; either
   7 * version 2.1 of the License, or (at your option) any later version.
   8 *
   9 * This library is distributed in the hope that it will be useful,
  10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12 * Lesser General Public License for more details.
  13 *
  14 * You should have received a copy of the GNU Lesser General Public
  15 * License along with this library.  If not, see
  16 * <http://www.gnu.org/licenses/>.
  17 *
  18 * Author: Daniel P. Berrange <berrange@redhat.com>
  19 */
  20
  21#include "qemu/osdep.h"
  22
  23#include "crypto-tls-x509-helpers.h"
  24#include "crypto/tlscredsx509.h"
  25#include "qapi/error.h"
  26
  27#ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
  28
  29#define WORKDIR "tests/test-crypto-tlscredsx509-work/"
  30#define KEYFILE WORKDIR "key-ctx.pem"
  31
  32struct QCryptoTLSCredsTestData {
  33    bool isServer;
  34    const char *cacrt;
  35    const char *crt;
  36    bool expectFail;
  37};
  38
  39
  40static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
  41                                              const char *certdir,
  42                                              Error **errp)
  43{
  44    Object *parent = object_get_objects_root();
  45    Object *creds = object_new_with_props(
  46        TYPE_QCRYPTO_TLS_CREDS_X509,
  47        parent,
  48        "testtlscreds",
  49        errp,
  50        "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
  51                     "server" : "client"),
  52        "dir", certdir,
  53        "verify-peer", "yes",
  54        "sanity-check", "yes",
  55        NULL);
  56
  57    if (*errp) {
  58        return NULL;
  59    }
  60    return QCRYPTO_TLS_CREDS(creds);
  61}
  62
  63/*
  64 * This tests sanity checking of our own certificates
  65 *
  66 * The code being tested is used when TLS creds are created,
  67 * and aim to ensure QMEU has been configured with sane
  68 * certificates. This allows us to give much much much
  69 * clearer error messages to the admin when they misconfigure
  70 * things.
  71 */
  72static void test_tls_creds(const void *opaque)
  73{
  74    struct QCryptoTLSCredsTestData *data =
  75        (struct QCryptoTLSCredsTestData *)opaque;
  76    QCryptoTLSCreds *creds;
  77    Error *err = NULL;
  78
  79#define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
  80    mkdir(CERT_DIR, 0700);
  81
  82    unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
  83    if (data->isServer) {
  84        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
  85        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
  86    } else {
  87        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
  88        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
  89    }
  90
  91    if (access(data->cacrt, R_OK) == 0) {
  92        g_assert(link(data->cacrt,
  93                      CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
  94    }
  95    if (data->isServer) {
  96        if (access(data->crt, R_OK) == 0) {
  97            g_assert(link(data->crt,
  98                          CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
  99        }
 100        g_assert(link(KEYFILE,
 101                      CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
 102    } else {
 103        if (access(data->crt, R_OK) == 0) {
 104            g_assert(link(data->crt,
 105                          CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
 106        }
 107        g_assert(link(KEYFILE,
 108                      CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
 109    }
 110
 111    creds = test_tls_creds_create(
 112        (data->isServer ?
 113         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
 114         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
 115        CERT_DIR,
 116        &err);
 117
 118    if (data->expectFail) {
 119        error_free(err);
 120        g_assert(creds == NULL);
 121    } else {
 122        if (err) {
 123            g_printerr("Failed to generate creds: %s\n",
 124                       error_get_pretty(err));
 125            error_free(err);
 126        }
 127        g_assert(creds != NULL);
 128    }
 129
 130    unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
 131    if (data->isServer) {
 132        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
 133        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
 134    } else {
 135        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
 136        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
 137    }
 138    rmdir(CERT_DIR);
 139    if (creds) {
 140        object_unparent(OBJECT(creds));
 141    }
 142}
 143
 144int main(int argc, char **argv)
 145{
 146    int ret;
 147
 148    module_call_init(MODULE_INIT_QOM);
 149    g_test_init(&argc, &argv, NULL);
 150    setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
 151
 152    mkdir(WORKDIR, 0700);
 153
 154    test_tls_init(KEYFILE);
 155
 156# define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail)           \
 157    struct QCryptoTLSCredsTestData name = {                             \
 158        isServer, caCrt, crt, expectFail                                \
 159    };                                                                  \
 160    g_test_add_data_func("/qcrypto/tlscredsx509/" # name,               \
 161                         &name, test_tls_creds);                        \
 162
 163    /* A perfect CA, perfect client & perfect server */
 164
 165    /* Basic:CA:critical */
 166    TLS_ROOT_REQ(cacertreq,
 167                 "UK", "qemu CA", NULL, NULL, NULL, NULL,
 168                 true, true, true,
 169                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 170                 false, false, NULL, NULL,
 171                 0, 0);
 172
 173    TLS_CERT_REQ(servercertreq, cacertreq,
 174                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 175                 true, true, false,
 176                 true, true,
 177                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 178                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 179                 0, 0);
 180    TLS_CERT_REQ(clientcertreq, cacertreq,
 181                 "UK", "qemu", NULL, NULL, NULL, NULL,
 182                 true, true, false,
 183                 true, true,
 184                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 185                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 186                 0, 0);
 187
 188    TLS_TEST_REG(perfectserver, true,
 189                 cacertreq.filename, servercertreq.filename, false);
 190    TLS_TEST_REG(perfectclient, false,
 191                 cacertreq.filename, clientcertreq.filename, false);
 192
 193
 194    /* Some other CAs which are good */
 195
 196    /* Basic:CA:critical */
 197    TLS_ROOT_REQ(cacert1req,
 198                 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
 199                 true, true, true,
 200                 false, false, 0,
 201                 false, false, NULL, NULL,
 202                 0, 0);
 203    TLS_CERT_REQ(servercert1req, cacert1req,
 204                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 205                 true, true, false,
 206                 true, true,
 207                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 208                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 209                 0, 0);
 210
 211    /* Basic:CA:not-critical */
 212    TLS_ROOT_REQ(cacert2req,
 213                 "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
 214                 true, false, true,
 215                 false, false, 0,
 216                 false, false, NULL, NULL,
 217                 0, 0);
 218    TLS_CERT_REQ(servercert2req, cacert2req,
 219                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 220                 true, true, false,
 221                 true, true,
 222                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 223                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 224                 0, 0);
 225
 226    /* Key usage:cert-sign:critical */
 227    TLS_ROOT_REQ(cacert3req,
 228                 "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
 229                 true, true, true,
 230                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 231                 false, false, NULL, NULL,
 232                 0, 0);
 233    TLS_CERT_REQ(servercert3req, cacert3req,
 234                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 235                 true, true, false,
 236                 true, true,
 237                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 238                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 239                 0, 0);
 240
 241    TLS_TEST_REG(goodca1, true,
 242                 cacert1req.filename, servercert1req.filename, false);
 243    TLS_TEST_REG(goodca2, true,
 244                 cacert2req.filename, servercert2req.filename, false);
 245    TLS_TEST_REG(goodca3, true,
 246                 cacert3req.filename, servercert3req.filename, false);
 247
 248    /* Now some bad certs */
 249
 250    /* Key usage:dig-sig:not-critical */
 251    TLS_ROOT_REQ(cacert4req,
 252                 "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
 253                 true, true, true,
 254                 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
 255                 false, false, NULL, NULL,
 256                 0, 0);
 257    TLS_CERT_REQ(servercert4req, cacert4req,
 258                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 259                 true, true, false,
 260                 true, true,
 261                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 262                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 263                 0, 0);
 264    /* no-basic */
 265    TLS_ROOT_REQ(cacert5req,
 266                 "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
 267                 false, false, false,
 268                 false, false, 0,
 269                 false, false, NULL, NULL,
 270                 0, 0);
 271    TLS_CERT_REQ(servercert5req, cacert5req,
 272                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 273                 true, true, false,
 274                 true, true,
 275                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 276                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 277                 0, 0);
 278    /* Key usage:dig-sig:critical */
 279    TLS_ROOT_REQ(cacert6req,
 280                 "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
 281                 true, true, true,
 282                 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
 283                 false, false, NULL, NULL,
 284                 0, 0);
 285    TLS_CERT_REQ(servercert6req, cacert6req,
 286                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 287                 true, true, false,
 288                 true, true,
 289                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 290                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 291                 0, 0);
 292
 293    /* Technically a CA cert with basic constraints
 294     * key purpose == key signing + non-critical should
 295     * be rejected. GNUTLS < 3.1 does not reject it and
 296     * we don't anticipate them changing this behaviour
 297     */
 298    TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
 299                (GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) ||
 300                GNUTLS_VERSION_MAJOR > 3);
 301    TLS_TEST_REG(badca2, true,
 302                 cacert5req.filename, servercert5req.filename, true);
 303    TLS_TEST_REG(badca3, true,
 304                 cacert6req.filename, servercert6req.filename, true);
 305
 306
 307    /* Various good servers */
 308    /* no usage or purpose */
 309    TLS_CERT_REQ(servercert7req, cacertreq,
 310                 "UK", "qemu", NULL, NULL, NULL, NULL,
 311                 true, true, false,
 312                 false, false, 0,
 313                 false, false, NULL, NULL,
 314                 0, 0);
 315    /* usage:cert-sign+dig-sig+encipher:critical */
 316    TLS_CERT_REQ(servercert8req, cacertreq,
 317                 "UK", "qemu", NULL, NULL, NULL, NULL,
 318                 true, true, false,
 319                 true, true,
 320                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 321                 GNUTLS_KEY_KEY_CERT_SIGN,
 322                 false, false, NULL, NULL,
 323                 0, 0);
 324    /* usage:cert-sign:not-critical */
 325    TLS_CERT_REQ(servercert9req, cacertreq,
 326                 "UK", "qemu", NULL, NULL, NULL, NULL,
 327                 true, true, false,
 328                 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 329                 false, false, NULL, NULL,
 330                 0, 0);
 331    /* purpose:server:critical */
 332    TLS_CERT_REQ(servercert10req, cacertreq,
 333                 "UK", "qemu", NULL, NULL, NULL, NULL,
 334                 true, true, false,
 335                 false, false, 0,
 336                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 337                 0, 0);
 338    /* purpose:server:not-critical */
 339    TLS_CERT_REQ(servercert11req, cacertreq,
 340                 "UK", "qemu", NULL, NULL, NULL, NULL,
 341                 true, true, false,
 342                 false, false, 0,
 343                 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 344                 0, 0);
 345    /* purpose:client+server:critical */
 346    TLS_CERT_REQ(servercert12req, cacertreq,
 347                 "UK", "qemu", NULL, NULL, NULL, NULL,
 348                 true, true, false,
 349                 false, false, 0,
 350                 true, true,
 351                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 352                 0, 0);
 353    /* purpose:client+server:not-critical */
 354    TLS_CERT_REQ(servercert13req, cacertreq,
 355                 "UK", "qemu", NULL, NULL, NULL, NULL,
 356                 true, true, false,
 357                 false, false, 0,
 358                 true, false,
 359                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 360                 0, 0);
 361
 362    TLS_TEST_REG(goodserver1, true,
 363                 cacertreq.filename, servercert7req.filename, false);
 364    TLS_TEST_REG(goodserver2, true,
 365                 cacertreq.filename, servercert8req.filename, false);
 366    TLS_TEST_REG(goodserver3, true,
 367                 cacertreq.filename, servercert9req.filename, false);
 368    TLS_TEST_REG(goodserver4, true,
 369                 cacertreq.filename, servercert10req.filename, false);
 370    TLS_TEST_REG(goodserver5, true,
 371                 cacertreq.filename, servercert11req.filename, false);
 372    TLS_TEST_REG(goodserver6, true,
 373                 cacertreq.filename, servercert12req.filename, false);
 374    TLS_TEST_REG(goodserver7, true,
 375                 cacertreq.filename, servercert13req.filename, false);
 376
 377    /* Bad servers */
 378
 379    /* usage:cert-sign:critical */
 380    TLS_CERT_REQ(servercert14req, cacertreq,
 381                 "UK", "qemu", NULL, NULL, NULL, NULL,
 382                 true, true, false,
 383                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 384                 false, false, NULL, NULL,
 385                 0, 0);
 386    /* purpose:client:critical */
 387    TLS_CERT_REQ(servercert15req, cacertreq,
 388                 "UK", "qemu", NULL, NULL, NULL, NULL,
 389                 true, true, false,
 390                 false, false, 0,
 391                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 392                 0, 0);
 393    /* usage: none:critical */
 394    TLS_CERT_REQ(servercert16req, cacertreq,
 395                 "UK", "qemu", NULL, NULL, NULL, NULL,
 396                 true, true, false,
 397                 true, true, 0,
 398                 false, false, NULL, NULL,
 399                 0, 0);
 400
 401    TLS_TEST_REG(badserver1, true,
 402                 cacertreq.filename, servercert14req.filename, true);
 403    TLS_TEST_REG(badserver2, true,
 404                 cacertreq.filename, servercert15req.filename, true);
 405    TLS_TEST_REG(badserver3, true,
 406                 cacertreq.filename, servercert16req.filename, true);
 407
 408
 409
 410    /* Various good clients */
 411    /* no usage or purpose */
 412    TLS_CERT_REQ(clientcert1req, cacertreq,
 413                 "UK", "qemu", NULL, NULL, NULL, NULL,
 414                 true, true, false,
 415                 false, false, 0,
 416                 false, false, NULL, NULL,
 417                 0, 0);
 418    /* usage:cert-sign+dig-sig+encipher:critical */
 419    TLS_CERT_REQ(clientcert2req, cacertreq,
 420                 "UK", "qemu", NULL, NULL, NULL, NULL,
 421                 true, true, false,
 422                 true, true,
 423                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 424                 GNUTLS_KEY_KEY_CERT_SIGN,
 425                 false, false, NULL, NULL,
 426                 0, 0);
 427    /* usage:cert-sign:not-critical */
 428    TLS_CERT_REQ(clientcert3req, cacertreq,
 429                 "UK", "qemu", NULL, NULL, NULL, NULL,
 430                 true, true, false,
 431                 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 432                 false, false, NULL, NULL,
 433                 0, 0);
 434    /* purpose:client:critical */
 435    TLS_CERT_REQ(clientcert4req, cacertreq,
 436                 "UK", "qemu", NULL, NULL, NULL, NULL,
 437                 true, true, false,
 438                 false, false, 0,
 439                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 440                 0, 0);
 441    /* purpose:client:not-critical */
 442    TLS_CERT_REQ(clientcert5req, cacertreq,
 443                 "UK", "qemu", NULL, NULL, NULL, NULL,
 444                 true, true, false,
 445                 false, false, 0,
 446                 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 447                 0, 0);
 448    /* purpose:client+client:critical */
 449    TLS_CERT_REQ(clientcert6req, cacertreq,
 450                 "UK", "qemu", NULL, NULL, NULL, NULL,
 451                 true, true, false,
 452                 false, false, 0,
 453                 true, true,
 454                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 455                 0, 0);
 456    /* purpose:client+client:not-critical */
 457    TLS_CERT_REQ(clientcert7req, cacertreq,
 458                 "UK", "qemu", NULL, NULL, NULL, NULL,
 459                 true, true, false,
 460                 false, false, 0,
 461                 true, false,
 462                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 463                 0, 0);
 464
 465    TLS_TEST_REG(goodclient1, false,
 466                 cacertreq.filename, clientcert1req.filename, false);
 467    TLS_TEST_REG(goodclient2, false,
 468                 cacertreq.filename, clientcert2req.filename, false);
 469    TLS_TEST_REG(goodclient3, false,
 470                 cacertreq.filename, clientcert3req.filename, false);
 471    TLS_TEST_REG(goodclient4, false,
 472                 cacertreq.filename, clientcert4req.filename, false);
 473    TLS_TEST_REG(goodclient5, false,
 474                 cacertreq.filename, clientcert5req.filename, false);
 475    TLS_TEST_REG(goodclient6, false,
 476                 cacertreq.filename, clientcert6req.filename, false);
 477    TLS_TEST_REG(goodclient7, false,
 478                 cacertreq.filename, clientcert7req.filename, false);
 479
 480    /* Bad clients */
 481
 482    /* usage:cert-sign:critical */
 483    TLS_CERT_REQ(clientcert8req, cacertreq,
 484                 "UK", "qemu", NULL, NULL, NULL, NULL,
 485                 true, true, false,
 486                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 487                 false, false, NULL, NULL,
 488                 0, 0);
 489    /* purpose:client:critical */
 490    TLS_CERT_REQ(clientcert9req, cacertreq,
 491                 "UK", "qemu", NULL, NULL, NULL, NULL,
 492                 true, true, false,
 493                 false, false, 0,
 494                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 495                 0, 0);
 496    /* usage: none:critical */
 497    TLS_CERT_REQ(clientcert10req, cacertreq,
 498                 "UK", "qemu", NULL, NULL, NULL, NULL,
 499                 true, true, false,
 500                 true, true, 0,
 501                 false, false, NULL, NULL,
 502                 0, 0);
 503
 504    TLS_TEST_REG(badclient1, false,
 505                 cacertreq.filename, clientcert8req.filename, true);
 506    TLS_TEST_REG(badclient2, false,
 507                 cacertreq.filename, clientcert9req.filename, true);
 508    TLS_TEST_REG(badclient3, false,
 509                 cacertreq.filename, clientcert10req.filename, true);
 510
 511
 512
 513    /* Expired stuff */
 514
 515    TLS_ROOT_REQ(cacertexpreq,
 516                 "UK", "qemu", NULL, NULL, NULL, NULL,
 517                 true, true, true,
 518                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 519                 false, false, NULL, NULL,
 520                 0, -1);
 521    TLS_CERT_REQ(servercertexpreq, cacertexpreq,
 522                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 523                 true, true, false,
 524                 true, true,
 525                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 526                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 527                 0, 0);
 528    TLS_CERT_REQ(servercertexp1req, cacertreq,
 529                 "UK", "qemu", NULL, NULL, NULL, NULL,
 530                 true, true, false,
 531                 true, true,
 532                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 533                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 534                 0, -1);
 535    TLS_CERT_REQ(clientcertexp1req, cacertreq,
 536                 "UK", "qemu", NULL, NULL, NULL, NULL,
 537                 true, true, false,
 538                 true, true,
 539                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 540                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 541                 0, -1);
 542
 543    TLS_TEST_REG(expired1, true,
 544                 cacertexpreq.filename, servercertexpreq.filename, true);
 545    TLS_TEST_REG(expired2, true,
 546                 cacertreq.filename, servercertexp1req.filename, true);
 547    TLS_TEST_REG(expired3, false,
 548                 cacertreq.filename, clientcertexp1req.filename, true);
 549
 550
 551    /* Not activated stuff */
 552
 553    TLS_ROOT_REQ(cacertnewreq,
 554                 "UK", "qemu", NULL, NULL, NULL, NULL,
 555                 true, true, true,
 556                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 557                 false, false, NULL, NULL,
 558                 1, 2);
 559    TLS_CERT_REQ(servercertnewreq, cacertnewreq,
 560                 "UK", "qemu", NULL, NULL, NULL, NULL,
 561                 true, true, false,
 562                 true, true,
 563                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 564                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 565                 0, 0);
 566    TLS_CERT_REQ(servercertnew1req, cacertreq,
 567                 "UK", "qemu", NULL, NULL, NULL, NULL,
 568                 true, true, false,
 569                 true, true,
 570                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 571                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 572                 1, 2);
 573    TLS_CERT_REQ(clientcertnew1req, cacertreq,
 574                 "UK", "qemu", NULL, NULL, NULL, NULL,
 575                 true, true, false,
 576                 true, true,
 577                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 578                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 579                 1, 2);
 580
 581    TLS_TEST_REG(inactive1, true,
 582                 cacertnewreq.filename, servercertnewreq.filename, true);
 583    TLS_TEST_REG(inactive2, true,
 584                 cacertreq.filename, servercertnew1req.filename, true);
 585    TLS_TEST_REG(inactive3, false,
 586                 cacertreq.filename, clientcertnew1req.filename, true);
 587
 588    TLS_ROOT_REQ(cacertrootreq,
 589                 "UK", "qemu root", NULL, NULL, NULL, NULL,
 590                 true, true, true,
 591                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 592                 false, false, NULL, NULL,
 593                 0, 0);
 594    TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
 595                 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
 596                 true, true, true,
 597                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 598                 false, false, NULL, NULL,
 599                 0, 0);
 600    TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
 601                 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
 602                 true, true, true,
 603                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 604                 false, false, NULL, NULL,
 605                 0, 0);
 606    TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
 607                 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
 608                 true, true, true,
 609                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 610                 false, false, NULL, NULL,
 611                 0, 0);
 612    TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
 613                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 614                 true, true, false,
 615                 true, true,
 616                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 617                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 618                 0, 0);
 619    TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
 620                 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
 621                 true, true, false,
 622                 true, true,
 623                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 624                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 625                 0, 0);
 626
 627    gnutls_x509_crt_t certchain[] = {
 628        cacertrootreq.crt,
 629        cacertlevel1areq.crt,
 630        cacertlevel1breq.crt,
 631        cacertlevel2areq.crt,
 632    };
 633
 634    test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
 635                              certchain,
 636                              G_N_ELEMENTS(certchain));
 637
 638    TLS_TEST_REG(chain1, true,
 639                 WORKDIR "cacertchain-ctx.pem",
 640                 servercertlevel3areq.filename, false);
 641    TLS_TEST_REG(chain2, false,
 642                 WORKDIR "cacertchain-ctx.pem",
 643                 clientcertlevel2breq.filename, false);
 644
 645    /* Some missing certs - first two are fatal, the last
 646     * is ok
 647     */
 648    TLS_TEST_REG(missingca, true,
 649                 "cacertdoesnotexist.pem",
 650                 servercert1req.filename, true);
 651    TLS_TEST_REG(missingserver, true,
 652                 cacert1req.filename,
 653                 "servercertdoesnotexist.pem", true);
 654    TLS_TEST_REG(missingclient, false,
 655                 cacert1req.filename,
 656                 "clientcertdoesnotexist.pem", false);
 657
 658    ret = g_test_run();
 659
 660    test_tls_discard_cert(&cacertreq);
 661    test_tls_discard_cert(&cacert1req);
 662    test_tls_discard_cert(&cacert2req);
 663    test_tls_discard_cert(&cacert3req);
 664    test_tls_discard_cert(&cacert4req);
 665    test_tls_discard_cert(&cacert5req);
 666    test_tls_discard_cert(&cacert6req);
 667
 668    test_tls_discard_cert(&servercertreq);
 669    test_tls_discard_cert(&servercert1req);
 670    test_tls_discard_cert(&servercert2req);
 671    test_tls_discard_cert(&servercert3req);
 672    test_tls_discard_cert(&servercert4req);
 673    test_tls_discard_cert(&servercert5req);
 674    test_tls_discard_cert(&servercert6req);
 675    test_tls_discard_cert(&servercert7req);
 676    test_tls_discard_cert(&servercert8req);
 677    test_tls_discard_cert(&servercert9req);
 678    test_tls_discard_cert(&servercert10req);
 679    test_tls_discard_cert(&servercert11req);
 680    test_tls_discard_cert(&servercert12req);
 681    test_tls_discard_cert(&servercert13req);
 682    test_tls_discard_cert(&servercert14req);
 683    test_tls_discard_cert(&servercert15req);
 684    test_tls_discard_cert(&servercert16req);
 685
 686    test_tls_discard_cert(&clientcertreq);
 687    test_tls_discard_cert(&clientcert1req);
 688    test_tls_discard_cert(&clientcert2req);
 689    test_tls_discard_cert(&clientcert3req);
 690    test_tls_discard_cert(&clientcert4req);
 691    test_tls_discard_cert(&clientcert5req);
 692    test_tls_discard_cert(&clientcert6req);
 693    test_tls_discard_cert(&clientcert7req);
 694    test_tls_discard_cert(&clientcert8req);
 695    test_tls_discard_cert(&clientcert9req);
 696    test_tls_discard_cert(&clientcert10req);
 697
 698    test_tls_discard_cert(&cacertexpreq);
 699    test_tls_discard_cert(&servercertexpreq);
 700    test_tls_discard_cert(&servercertexp1req);
 701    test_tls_discard_cert(&clientcertexp1req);
 702
 703    test_tls_discard_cert(&cacertnewreq);
 704    test_tls_discard_cert(&servercertnewreq);
 705    test_tls_discard_cert(&servercertnew1req);
 706    test_tls_discard_cert(&clientcertnew1req);
 707
 708    test_tls_discard_cert(&cacertrootreq);
 709    test_tls_discard_cert(&cacertlevel1areq);
 710    test_tls_discard_cert(&cacertlevel1breq);
 711    test_tls_discard_cert(&cacertlevel2areq);
 712    test_tls_discard_cert(&servercertlevel3areq);
 713    test_tls_discard_cert(&clientcertlevel2breq);
 714    unlink(WORKDIR "cacertchain-ctx.pem");
 715
 716    test_tls_cleanup(KEYFILE);
 717    rmdir(WORKDIR);
 718
 719    return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 720}
 721
 722#else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 723
 724int
 725main(void)
 726{
 727    return EXIT_SUCCESS;
 728}
 729
 730#endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 731