LXR qemu/tests/test-crypto-tlscredsx509.c

   1/*
   2 * Copyright (C) 2015 Red Hat, Inc.
   3 *
   4 * This library is free software; you can redistribute it and/or
   5 * modify it under the terms of the GNU Lesser General Public
   6 * License as published by the Free Software Foundation; either
   7 * version 2.1 of the License, or (at your option) any later version.
   8 *
   9 * This library is distributed in the hope that it will be useful,
  10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12 * Lesser General Public License for more details.
  13 *
  14 * You should have received a copy of the GNU Lesser General Public
  15 * License along with this library.  If not, see
  16 * <http://www.gnu.org/licenses/>.
  17 *
  18 * Author: Daniel P. Berrange <berrange@redhat.com>
  19 */
  20
  21#include "qemu/osdep.h"
  22
  23#include "crypto-tls-x509-helpers.h"
  24#include "crypto/tlscredsx509.h"
  25#include "qapi/error.h"
  26
  27#ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
  28
  29#define WORKDIR "tests/test-crypto-tlscredsx509-work/"
  30#define KEYFILE WORKDIR "key-ctx.pem"
  31
  32struct QCryptoTLSCredsTestData {
  33    bool isServer;
  34    const char *cacrt;
  35    const char *crt;
  36    bool expectFail;
  37};
  38
  39
  40static QCryptoTLSCreds *test_tls_creds_create(QCryptoTLSCredsEndpoint endpoint,
  41                                              const char *certdir,
  42                                              Error **errp)
  43{
  44    Object *parent = object_get_objects_root();
  45    Object *creds = object_new_with_props(
  46        TYPE_QCRYPTO_TLS_CREDS_X509,
  47        parent,
  48        "testtlscreds",
  49        errp,
  50        "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
  51                     "server" : "client"),
  52        "dir", certdir,
  53        "verify-peer", "yes",
  54        "sanity-check", "yes",
  55        NULL);
  56
  57    if (!creds) {
  58        return NULL;
  59    }
  60    return QCRYPTO_TLS_CREDS(creds);
  61}
  62
  63/*
  64 * This tests sanity checking of our own certificates
  65 *
  66 * The code being tested is used when TLS creds are created,
  67 * and aim to ensure QMEU has been configured with sane
  68 * certificates. This allows us to give much much much
  69 * clearer error messages to the admin when they misconfigure
  70 * things.
  71 */
  72static void test_tls_creds(const void *opaque)
  73{
  74    struct QCryptoTLSCredsTestData *data =
  75        (struct QCryptoTLSCredsTestData *)opaque;
  76    QCryptoTLSCreds *creds;
  77
  78#define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
  79    mkdir(CERT_DIR, 0700);
  80
  81    unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
  82    if (data->isServer) {
  83        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
  84        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
  85    } else {
  86        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
  87        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
  88    }
  89
  90    if (access(data->cacrt, R_OK) == 0) {
  91        g_assert(link(data->cacrt,
  92                      CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
  93    }
  94    if (data->isServer) {
  95        if (access(data->crt, R_OK) == 0) {
  96            g_assert(link(data->crt,
  97                          CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
  98        }
  99        g_assert(link(KEYFILE,
 100                      CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
 101    } else {
 102        if (access(data->crt, R_OK) == 0) {
 103            g_assert(link(data->crt,
 104                          CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
 105        }
 106        g_assert(link(KEYFILE,
 107                      CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
 108    }
 109
 110    creds = test_tls_creds_create(
 111        (data->isServer ?
 112         QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
 113         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
 114        CERT_DIR,
 115        data->expectFail ? NULL : &error_abort);
 116
 117    if (data->expectFail) {
 118        g_assert(creds == NULL);
 119    } else {
 120        g_assert(creds != NULL);
 121    }
 122
 123    unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
 124    if (data->isServer) {
 125        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
 126        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
 127    } else {
 128        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
 129        unlink(CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
 130    }
 131    rmdir(CERT_DIR);
 132    if (creds) {
 133        object_unparent(OBJECT(creds));
 134    }
 135}
 136
 137int main(int argc, char **argv)
 138{
 139    int ret;
 140
 141    module_call_init(MODULE_INIT_QOM);
 142    g_test_init(&argc, &argv, NULL);
 143    setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
 144
 145    mkdir(WORKDIR, 0700);
 146
 147    test_tls_init(KEYFILE);
 148
 149# define TLS_TEST_REG(name, isServer, caCrt, crt, expectFail)           \
 150    struct QCryptoTLSCredsTestData name = {                             \
 151        isServer, caCrt, crt, expectFail                                \
 152    };                                                                  \
 153    g_test_add_data_func("/qcrypto/tlscredsx509/" # name,               \
 154                         &name, test_tls_creds);                        \
 155
 156    /* A perfect CA, perfect client & perfect server */
 157
 158    /* Basic:CA:critical */
 159    TLS_ROOT_REQ(cacertreq,
 160                 "UK", "qemu CA", NULL, NULL, NULL, NULL,
 161                 true, true, true,
 162                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 163                 false, false, NULL, NULL,
 164                 0, 0);
 165
 166    TLS_CERT_REQ(servercertreq, cacertreq,
 167                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 168                 true, true, false,
 169                 true, true,
 170                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 171                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 172                 0, 0);
 173    TLS_CERT_REQ(clientcertreq, cacertreq,
 174                 "UK", "qemu", NULL, NULL, NULL, NULL,
 175                 true, true, false,
 176                 true, true,
 177                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 178                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 179                 0, 0);
 180
 181    TLS_TEST_REG(perfectserver, true,
 182                 cacertreq.filename, servercertreq.filename, false);
 183    TLS_TEST_REG(perfectclient, false,
 184                 cacertreq.filename, clientcertreq.filename, false);
 185
 186
 187    /* Some other CAs which are good */
 188
 189    /* Basic:CA:critical */
 190    TLS_ROOT_REQ(cacert1req,
 191                 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
 192                 true, true, true,
 193                 false, false, 0,
 194                 false, false, NULL, NULL,
 195                 0, 0);
 196    TLS_CERT_REQ(servercert1req, cacert1req,
 197                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 198                 true, true, false,
 199                 true, true,
 200                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 201                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 202                 0, 0);
 203
 204    /* Basic:CA:not-critical */
 205    TLS_ROOT_REQ(cacert2req,
 206                 "UK", "qemu CA 2", NULL, NULL, NULL, NULL,
 207                 true, false, true,
 208                 false, false, 0,
 209                 false, false, NULL, NULL,
 210                 0, 0);
 211    TLS_CERT_REQ(servercert2req, cacert2req,
 212                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 213                 true, true, false,
 214                 true, true,
 215                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 216                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 217                 0, 0);
 218
 219    /* Key usage:cert-sign:critical */
 220    TLS_ROOT_REQ(cacert3req,
 221                 "UK", "qemu CA 3", NULL, NULL, NULL, NULL,
 222                 true, true, true,
 223                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 224                 false, false, NULL, NULL,
 225                 0, 0);
 226    TLS_CERT_REQ(servercert3req, cacert3req,
 227                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 228                 true, true, false,
 229                 true, true,
 230                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 231                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 232                 0, 0);
 233
 234    TLS_TEST_REG(goodca1, true,
 235                 cacert1req.filename, servercert1req.filename, false);
 236    TLS_TEST_REG(goodca2, true,
 237                 cacert2req.filename, servercert2req.filename, false);
 238    TLS_TEST_REG(goodca3, true,
 239                 cacert3req.filename, servercert3req.filename, false);
 240
 241    /* Now some bad certs */
 242
 243    /* Key usage:dig-sig:not-critical */
 244    TLS_ROOT_REQ(cacert4req,
 245                 "UK", "qemu CA 4", NULL, NULL, NULL, NULL,
 246                 true, true, true,
 247                 true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
 248                 false, false, NULL, NULL,
 249                 0, 0);
 250    TLS_CERT_REQ(servercert4req, cacert4req,
 251                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 252                 true, true, false,
 253                 true, true,
 254                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 255                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 256                 0, 0);
 257    /* no-basic */
 258    TLS_ROOT_REQ(cacert5req,
 259                 "UK", "qemu CA 5", NULL, NULL, NULL, NULL,
 260                 false, false, false,
 261                 false, false, 0,
 262                 false, false, NULL, NULL,
 263                 0, 0);
 264    TLS_CERT_REQ(servercert5req, cacert5req,
 265                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 266                 true, true, false,
 267                 true, true,
 268                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 269                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 270                 0, 0);
 271    /* Key usage:dig-sig:critical */
 272    TLS_ROOT_REQ(cacert6req,
 273                 "UK", "qemu CA 6", NULL, NULL, NULL, NULL,
 274                 true, true, true,
 275                 true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
 276                 false, false, NULL, NULL,
 277                 0, 0);
 278    TLS_CERT_REQ(servercert6req, cacert6req,
 279                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 280                 true, true, false,
 281                 true, true,
 282                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 283                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 284                 0, 0);
 285
 286    TLS_TEST_REG(badca1, true, cacert4req.filename, servercert4req.filename,
 287                 true);
 288    TLS_TEST_REG(badca2, true,
 289                 cacert5req.filename, servercert5req.filename, true);
 290    TLS_TEST_REG(badca3, true,
 291                 cacert6req.filename, servercert6req.filename, true);
 292
 293
 294    /* Various good servers */
 295    /* no usage or purpose */
 296    TLS_CERT_REQ(servercert7req, cacertreq,
 297                 "UK", "qemu", NULL, NULL, NULL, NULL,
 298                 true, true, false,
 299                 false, false, 0,
 300                 false, false, NULL, NULL,
 301                 0, 0);
 302    /* usage:cert-sign+dig-sig+encipher:critical */
 303    TLS_CERT_REQ(servercert8req, cacertreq,
 304                 "UK", "qemu", NULL, NULL, NULL, NULL,
 305                 true, true, false,
 306                 true, true,
 307                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 308                 GNUTLS_KEY_KEY_CERT_SIGN,
 309                 false, false, NULL, NULL,
 310                 0, 0);
 311    /* usage:cert-sign:not-critical */
 312    TLS_CERT_REQ(servercert9req, cacertreq,
 313                 "UK", "qemu", NULL, NULL, NULL, NULL,
 314                 true, true, false,
 315                 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 316                 false, false, NULL, NULL,
 317                 0, 0);
 318    /* purpose:server:critical */
 319    TLS_CERT_REQ(servercert10req, cacertreq,
 320                 "UK", "qemu", NULL, NULL, NULL, NULL,
 321                 true, true, false,
 322                 false, false, 0,
 323                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 324                 0, 0);
 325    /* purpose:server:not-critical */
 326    TLS_CERT_REQ(servercert11req, cacertreq,
 327                 "UK", "qemu", NULL, NULL, NULL, NULL,
 328                 true, true, false,
 329                 false, false, 0,
 330                 true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 331                 0, 0);
 332    /* purpose:client+server:critical */
 333    TLS_CERT_REQ(servercert12req, cacertreq,
 334                 "UK", "qemu", NULL, NULL, NULL, NULL,
 335                 true, true, false,
 336                 false, false, 0,
 337                 true, true,
 338                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 339                 0, 0);
 340    /* purpose:client+server:not-critical */
 341    TLS_CERT_REQ(servercert13req, cacertreq,
 342                 "UK", "qemu", NULL, NULL, NULL, NULL,
 343                 true, true, false,
 344                 false, false, 0,
 345                 true, false,
 346                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 347                 0, 0);
 348
 349    TLS_TEST_REG(goodserver1, true,
 350                 cacertreq.filename, servercert7req.filename, false);
 351    TLS_TEST_REG(goodserver2, true,
 352                 cacertreq.filename, servercert8req.filename, false);
 353    TLS_TEST_REG(goodserver3, true,
 354                 cacertreq.filename, servercert9req.filename, false);
 355    TLS_TEST_REG(goodserver4, true,
 356                 cacertreq.filename, servercert10req.filename, false);
 357    TLS_TEST_REG(goodserver5, true,
 358                 cacertreq.filename, servercert11req.filename, false);
 359    TLS_TEST_REG(goodserver6, true,
 360                 cacertreq.filename, servercert12req.filename, false);
 361    TLS_TEST_REG(goodserver7, true,
 362                 cacertreq.filename, servercert13req.filename, false);
 363
 364    /* Bad servers */
 365
 366    /* usage:cert-sign:critical */
 367    TLS_CERT_REQ(servercert14req, cacertreq,
 368                 "UK", "qemu", NULL, NULL, NULL, NULL,
 369                 true, true, false,
 370                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 371                 false, false, NULL, NULL,
 372                 0, 0);
 373    /* purpose:client:critical */
 374    TLS_CERT_REQ(servercert15req, cacertreq,
 375                 "UK", "qemu", NULL, NULL, NULL, NULL,
 376                 true, true, false,
 377                 false, false, 0,
 378                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 379                 0, 0);
 380    /* usage: none:critical */
 381    TLS_CERT_REQ(servercert16req, cacertreq,
 382                 "UK", "qemu", NULL, NULL, NULL, NULL,
 383                 true, true, false,
 384                 true, true, 0,
 385                 false, false, NULL, NULL,
 386                 0, 0);
 387
 388    TLS_TEST_REG(badserver1, true,
 389                 cacertreq.filename, servercert14req.filename, true);
 390    TLS_TEST_REG(badserver2, true,
 391                 cacertreq.filename, servercert15req.filename, true);
 392    TLS_TEST_REG(badserver3, true,
 393                 cacertreq.filename, servercert16req.filename, true);
 394
 395
 396
 397    /* Various good clients */
 398    /* no usage or purpose */
 399    TLS_CERT_REQ(clientcert1req, cacertreq,
 400                 "UK", "qemu", NULL, NULL, NULL, NULL,
 401                 true, true, false,
 402                 false, false, 0,
 403                 false, false, NULL, NULL,
 404                 0, 0);
 405    /* usage:cert-sign+dig-sig+encipher:critical */
 406    TLS_CERT_REQ(clientcert2req, cacertreq,
 407                 "UK", "qemu", NULL, NULL, NULL, NULL,
 408                 true, true, false,
 409                 true, true,
 410                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
 411                 GNUTLS_KEY_KEY_CERT_SIGN,
 412                 false, false, NULL, NULL,
 413                 0, 0);
 414    /* usage:cert-sign:not-critical */
 415    TLS_CERT_REQ(clientcert3req, cacertreq,
 416                 "UK", "qemu", NULL, NULL, NULL, NULL,
 417                 true, true, false,
 418                 true, false, GNUTLS_KEY_KEY_CERT_SIGN,
 419                 false, false, NULL, NULL,
 420                 0, 0);
 421    /* purpose:client:critical */
 422    TLS_CERT_REQ(clientcert4req, cacertreq,
 423                 "UK", "qemu", NULL, NULL, NULL, NULL,
 424                 true, true, false,
 425                 false, false, 0,
 426                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 427                 0, 0);
 428    /* purpose:client:not-critical */
 429    TLS_CERT_REQ(clientcert5req, cacertreq,
 430                 "UK", "qemu", NULL, NULL, NULL, NULL,
 431                 true, true, false,
 432                 false, false, 0,
 433                 true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 434                 0, 0);
 435    /* purpose:client+client:critical */
 436    TLS_CERT_REQ(clientcert6req, cacertreq,
 437                 "UK", "qemu", NULL, NULL, NULL, NULL,
 438                 true, true, false,
 439                 false, false, 0,
 440                 true, true,
 441                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 442                 0, 0);
 443    /* purpose:client+client:not-critical */
 444    TLS_CERT_REQ(clientcert7req, cacertreq,
 445                 "UK", "qemu", NULL, NULL, NULL, NULL,
 446                 true, true, false,
 447                 false, false, 0,
 448                 true, false,
 449                 GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
 450                 0, 0);
 451
 452    TLS_TEST_REG(goodclient1, false,
 453                 cacertreq.filename, clientcert1req.filename, false);
 454    TLS_TEST_REG(goodclient2, false,
 455                 cacertreq.filename, clientcert2req.filename, false);
 456    TLS_TEST_REG(goodclient3, false,
 457                 cacertreq.filename, clientcert3req.filename, false);
 458    TLS_TEST_REG(goodclient4, false,
 459                 cacertreq.filename, clientcert4req.filename, false);
 460    TLS_TEST_REG(goodclient5, false,
 461                 cacertreq.filename, clientcert5req.filename, false);
 462    TLS_TEST_REG(goodclient6, false,
 463                 cacertreq.filename, clientcert6req.filename, false);
 464    TLS_TEST_REG(goodclient7, false,
 465                 cacertreq.filename, clientcert7req.filename, false);
 466
 467    /* Bad clients */
 468
 469    /* usage:cert-sign:critical */
 470    TLS_CERT_REQ(clientcert8req, cacertreq,
 471                 "UK", "qemu", NULL, NULL, NULL, NULL,
 472                 true, true, false,
 473                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 474                 false, false, NULL, NULL,
 475                 0, 0);
 476    /* purpose:client:critical */
 477    TLS_CERT_REQ(clientcert9req, cacertreq,
 478                 "UK", "qemu", NULL, NULL, NULL, NULL,
 479                 true, true, false,
 480                 false, false, 0,
 481                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 482                 0, 0);
 483    /* usage: none:critical */
 484    TLS_CERT_REQ(clientcert10req, cacertreq,
 485                 "UK", "qemu", NULL, NULL, NULL, NULL,
 486                 true, true, false,
 487                 true, true, 0,
 488                 false, false, NULL, NULL,
 489                 0, 0);
 490
 491    TLS_TEST_REG(badclient1, false,
 492                 cacertreq.filename, clientcert8req.filename, true);
 493    TLS_TEST_REG(badclient2, false,
 494                 cacertreq.filename, clientcert9req.filename, true);
 495    TLS_TEST_REG(badclient3, false,
 496                 cacertreq.filename, clientcert10req.filename, true);
 497
 498
 499
 500    /* Expired stuff */
 501
 502    TLS_ROOT_REQ(cacertexpreq,
 503                 "UK", "qemu", NULL, NULL, NULL, NULL,
 504                 true, true, true,
 505                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 506                 false, false, NULL, NULL,
 507                 0, -1);
 508    TLS_CERT_REQ(servercertexpreq, cacertexpreq,
 509                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 510                 true, true, false,
 511                 true, true,
 512                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 513                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 514                 0, 0);
 515    TLS_CERT_REQ(servercertexp1req, cacertreq,
 516                 "UK", "qemu", NULL, NULL, NULL, NULL,
 517                 true, true, false,
 518                 true, true,
 519                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 520                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 521                 0, -1);
 522    TLS_CERT_REQ(clientcertexp1req, cacertreq,
 523                 "UK", "qemu", NULL, NULL, NULL, NULL,
 524                 true, true, false,
 525                 true, true,
 526                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 527                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 528                 0, -1);
 529
 530    TLS_TEST_REG(expired1, true,
 531                 cacertexpreq.filename, servercertexpreq.filename, true);
 532    TLS_TEST_REG(expired2, true,
 533                 cacertreq.filename, servercertexp1req.filename, true);
 534    TLS_TEST_REG(expired3, false,
 535                 cacertreq.filename, clientcertexp1req.filename, true);
 536
 537
 538    /* Not activated stuff */
 539
 540    TLS_ROOT_REQ(cacertnewreq,
 541                 "UK", "qemu", NULL, NULL, NULL, NULL,
 542                 true, true, true,
 543                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 544                 false, false, NULL, NULL,
 545                 1, 2);
 546    TLS_CERT_REQ(servercertnewreq, cacertnewreq,
 547                 "UK", "qemu", NULL, NULL, NULL, NULL,
 548                 true, true, false,
 549                 true, true,
 550                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 551                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 552                 0, 0);
 553    TLS_CERT_REQ(servercertnew1req, cacertreq,
 554                 "UK", "qemu", NULL, NULL, NULL, NULL,
 555                 true, true, false,
 556                 true, true,
 557                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 558                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 559                 1, 2);
 560    TLS_CERT_REQ(clientcertnew1req, cacertreq,
 561                 "UK", "qemu", NULL, NULL, NULL, NULL,
 562                 true, true, false,
 563                 true, true,
 564                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 565                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 566                 1, 2);
 567
 568    TLS_TEST_REG(inactive1, true,
 569                 cacertnewreq.filename, servercertnewreq.filename, true);
 570    TLS_TEST_REG(inactive2, true,
 571                 cacertreq.filename, servercertnew1req.filename, true);
 572    TLS_TEST_REG(inactive3, false,
 573                 cacertreq.filename, clientcertnew1req.filename, true);
 574
 575    TLS_ROOT_REQ(cacertrootreq,
 576                 "UK", "qemu root", NULL, NULL, NULL, NULL,
 577                 true, true, true,
 578                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 579                 false, false, NULL, NULL,
 580                 0, 0);
 581    TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
 582                 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
 583                 true, true, true,
 584                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 585                 false, false, NULL, NULL,
 586                 0, 0);
 587    TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
 588                 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
 589                 true, true, true,
 590                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 591                 false, false, NULL, NULL,
 592                 0, 0);
 593    TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
 594                 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
 595                 true, true, true,
 596                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
 597                 false, false, NULL, NULL,
 598                 0, 0);
 599    TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
 600                 "UK", "qemu.org", NULL, NULL, NULL, NULL,
 601                 true, true, false,
 602                 true, true,
 603                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 604                 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
 605                 0, 0);
 606    TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
 607                 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
 608                 true, true, false,
 609                 true, true,
 610                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
 611                 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
 612                 0, 0);
 613
 614    gnutls_x509_crt_t certchain[] = {
 615        cacertrootreq.crt,
 616        cacertlevel1areq.crt,
 617        cacertlevel1breq.crt,
 618        cacertlevel2areq.crt,
 619    };
 620
 621    test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
 622                              certchain,
 623                              G_N_ELEMENTS(certchain));
 624
 625    TLS_TEST_REG(chain1, true,
 626                 WORKDIR "cacertchain-ctx.pem",
 627                 servercertlevel3areq.filename, false);
 628    TLS_TEST_REG(chain2, false,
 629                 WORKDIR "cacertchain-ctx.pem",
 630                 clientcertlevel2breq.filename, false);
 631
 632    /* Some missing certs - first two are fatal, the last
 633     * is ok
 634     */
 635    TLS_TEST_REG(missingca, true,
 636                 "cacertdoesnotexist.pem",
 637                 servercert1req.filename, true);
 638    TLS_TEST_REG(missingserver, true,
 639                 cacert1req.filename,
 640                 "servercertdoesnotexist.pem", true);
 641    TLS_TEST_REG(missingclient, false,
 642                 cacert1req.filename,
 643                 "clientcertdoesnotexist.pem", false);
 644
 645    ret = g_test_run();
 646
 647    test_tls_discard_cert(&cacertreq);
 648    test_tls_discard_cert(&cacert1req);
 649    test_tls_discard_cert(&cacert2req);
 650    test_tls_discard_cert(&cacert3req);
 651    test_tls_discard_cert(&cacert4req);
 652    test_tls_discard_cert(&cacert5req);
 653    test_tls_discard_cert(&cacert6req);
 654
 655    test_tls_discard_cert(&servercertreq);
 656    test_tls_discard_cert(&servercert1req);
 657    test_tls_discard_cert(&servercert2req);
 658    test_tls_discard_cert(&servercert3req);
 659    test_tls_discard_cert(&servercert4req);
 660    test_tls_discard_cert(&servercert5req);
 661    test_tls_discard_cert(&servercert6req);
 662    test_tls_discard_cert(&servercert7req);
 663    test_tls_discard_cert(&servercert8req);
 664    test_tls_discard_cert(&servercert9req);
 665    test_tls_discard_cert(&servercert10req);
 666    test_tls_discard_cert(&servercert11req);
 667    test_tls_discard_cert(&servercert12req);
 668    test_tls_discard_cert(&servercert13req);
 669    test_tls_discard_cert(&servercert14req);
 670    test_tls_discard_cert(&servercert15req);
 671    test_tls_discard_cert(&servercert16req);
 672
 673    test_tls_discard_cert(&clientcertreq);
 674    test_tls_discard_cert(&clientcert1req);
 675    test_tls_discard_cert(&clientcert2req);
 676    test_tls_discard_cert(&clientcert3req);
 677    test_tls_discard_cert(&clientcert4req);
 678    test_tls_discard_cert(&clientcert5req);
 679    test_tls_discard_cert(&clientcert6req);
 680    test_tls_discard_cert(&clientcert7req);
 681    test_tls_discard_cert(&clientcert8req);
 682    test_tls_discard_cert(&clientcert9req);
 683    test_tls_discard_cert(&clientcert10req);
 684
 685    test_tls_discard_cert(&cacertexpreq);
 686    test_tls_discard_cert(&servercertexpreq);
 687    test_tls_discard_cert(&servercertexp1req);
 688    test_tls_discard_cert(&clientcertexp1req);
 689
 690    test_tls_discard_cert(&cacertnewreq);
 691    test_tls_discard_cert(&servercertnewreq);
 692    test_tls_discard_cert(&servercertnew1req);
 693    test_tls_discard_cert(&clientcertnew1req);
 694
 695    test_tls_discard_cert(&cacertrootreq);
 696    test_tls_discard_cert(&cacertlevel1areq);
 697    test_tls_discard_cert(&cacertlevel1breq);
 698    test_tls_discard_cert(&cacertlevel2areq);
 699    test_tls_discard_cert(&servercertlevel3areq);
 700    test_tls_discard_cert(&clientcertlevel2breq);
 701    unlink(WORKDIR "cacertchain-ctx.pem");
 702
 703    test_tls_cleanup(KEYFILE);
 704    rmdir(WORKDIR);
 705
 706    return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 707}
 708
 709#else /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 710
 711int
 712main(void)
 713{
 714    return EXIT_SUCCESS;
 715}
 716
 717#endif /* ! QCRYPTO_HAVE_TLS_TEST_SUPPORT */
 718