1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include "qemu/osdep.h"
22
23#include "crypto-tls-x509-helpers.h"
24#include "crypto-tls-psk-helpers.h"
25#include "crypto/tlscredsx509.h"
26#include "crypto/tlscredspsk.h"
27#include "crypto/tlssession.h"
28#include "qom/object_interfaces.h"
29#include "qapi/error.h"
30#include "qemu/sockets.h"
31#include "authz/list.h"
32
33#ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT
34
35#define WORKDIR "tests/test-crypto-tlssession-work/"
36#define PSKFILE WORKDIR "keys.psk"
37#define KEYFILE WORKDIR "key-ctx.pem"
38
39static ssize_t testWrite(const char *buf, size_t len, void *opaque)
40{
41 int *fd = opaque;
42
43 return write(*fd, buf, len);
44}
45
46static ssize_t testRead(char *buf, size_t len, void *opaque)
47{
48 int *fd = opaque;
49
50 return read(*fd, buf, len);
51}
52
53static QCryptoTLSCreds *test_tls_creds_psk_create(
54 QCryptoTLSCredsEndpoint endpoint,
55 const char *dir)
56{
57 Object *parent = object_get_objects_root();
58 Object *creds = object_new_with_props(
59 TYPE_QCRYPTO_TLS_CREDS_PSK,
60 parent,
61 (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
62 "testtlscredsserver" : "testtlscredsclient"),
63 &error_abort,
64 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
65 "server" : "client"),
66 "dir", dir,
67 "priority", "NORMAL",
68 NULL
69 );
70 return QCRYPTO_TLS_CREDS(creds);
71}
72
73
74static void test_crypto_tls_session_psk(void)
75{
76 QCryptoTLSCreds *clientCreds;
77 QCryptoTLSCreds *serverCreds;
78 QCryptoTLSSession *clientSess = NULL;
79 QCryptoTLSSession *serverSess = NULL;
80 int channel[2];
81 bool clientShake = false;
82 bool serverShake = false;
83 int ret;
84
85
86 ret = socketpair(AF_UNIX, SOCK_STREAM, 0, channel);
87 g_assert(ret == 0);
88
89
90
91
92
93
94 qemu_set_nonblock(channel[0]);
95 qemu_set_nonblock(channel[1]);
96
97 clientCreds = test_tls_creds_psk_create(
98 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
99 WORKDIR);
100 g_assert(clientCreds != NULL);
101
102 serverCreds = test_tls_creds_psk_create(
103 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
104 WORKDIR);
105 g_assert(serverCreds != NULL);
106
107
108 clientSess = qcrypto_tls_session_new(
109 clientCreds, NULL, NULL,
110 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, &error_abort);
111 g_assert(clientSess != NULL);
112
113 serverSess = qcrypto_tls_session_new(
114 serverCreds, NULL, NULL,
115 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, &error_abort);
116 g_assert(serverSess != NULL);
117
118
119
120
121 qcrypto_tls_session_set_callbacks(serverSess,
122 testWrite, testRead,
123 &channel[0]);
124 qcrypto_tls_session_set_callbacks(clientSess,
125 testWrite, testRead,
126 &channel[1]);
127
128
129
130
131
132
133
134 do {
135 int rv;
136 if (!serverShake) {
137 rv = qcrypto_tls_session_handshake(serverSess,
138 &error_abort);
139 g_assert(rv >= 0);
140 if (qcrypto_tls_session_get_handshake_status(serverSess) ==
141 QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
142 serverShake = true;
143 }
144 }
145 if (!clientShake) {
146 rv = qcrypto_tls_session_handshake(clientSess,
147 &error_abort);
148 g_assert(rv >= 0);
149 if (qcrypto_tls_session_get_handshake_status(clientSess) ==
150 QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
151 clientShake = true;
152 }
153 }
154 } while (!clientShake || !serverShake);
155
156
157
158 g_assert(qcrypto_tls_session_check_credentials(serverSess,
159 &error_abort) == 0);
160 g_assert(qcrypto_tls_session_check_credentials(clientSess,
161 &error_abort) == 0);
162
163 object_unparent(OBJECT(serverCreds));
164 object_unparent(OBJECT(clientCreds));
165
166 qcrypto_tls_session_free(serverSess);
167 qcrypto_tls_session_free(clientSess);
168
169 close(channel[0]);
170 close(channel[1]);
171}
172
173
174struct QCryptoTLSSessionTestData {
175 const char *servercacrt;
176 const char *clientcacrt;
177 const char *servercrt;
178 const char *clientcrt;
179 bool expectServerFail;
180 bool expectClientFail;
181 const char *hostname;
182 const char *const *wildcards;
183};
184
185static QCryptoTLSCreds *test_tls_creds_x509_create(
186 QCryptoTLSCredsEndpoint endpoint,
187 const char *certdir)
188{
189 Object *parent = object_get_objects_root();
190 Object *creds = object_new_with_props(
191 TYPE_QCRYPTO_TLS_CREDS_X509,
192 parent,
193 (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
194 "testtlscredsserver" : "testtlscredsclient"),
195 &error_abort,
196 "endpoint", (endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER ?
197 "server" : "client"),
198 "dir", certdir,
199 "verify-peer", "yes",
200 "priority", "NORMAL",
201
202
203
204
205
206
207 "sanity-check", "no",
208 NULL
209 );
210 return QCRYPTO_TLS_CREDS(creds);
211}
212
213
214
215
216
217
218
219
220
221
222
223
224static void test_crypto_tls_session_x509(const void *opaque)
225{
226 struct QCryptoTLSSessionTestData *data =
227 (struct QCryptoTLSSessionTestData *)opaque;
228 QCryptoTLSCreds *clientCreds;
229 QCryptoTLSCreds *serverCreds;
230 QCryptoTLSSession *clientSess = NULL;
231 QCryptoTLSSession *serverSess = NULL;
232 QAuthZList *auth;
233 const char * const *wildcards;
234 int channel[2];
235 bool clientShake = false;
236 bool serverShake = false;
237 int ret;
238
239
240 ret = socketpair(AF_UNIX, SOCK_STREAM, 0, channel);
241 g_assert(ret == 0);
242
243
244
245
246
247
248 qemu_set_nonblock(channel[0]);
249 qemu_set_nonblock(channel[1]);
250
251#define CLIENT_CERT_DIR "tests/test-crypto-tlssession-client/"
252#define SERVER_CERT_DIR "tests/test-crypto-tlssession-server/"
253 mkdir(CLIENT_CERT_DIR, 0700);
254 mkdir(SERVER_CERT_DIR, 0700);
255
256 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
257 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
258 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
259
260 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
261 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
262 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
263
264 g_assert(link(data->servercacrt,
265 SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
266 g_assert(link(data->servercrt,
267 SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
268 g_assert(link(KEYFILE,
269 SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
270
271 g_assert(link(data->clientcacrt,
272 CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT) == 0);
273 g_assert(link(data->clientcrt,
274 CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
275 g_assert(link(KEYFILE,
276 CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
277
278 clientCreds = test_tls_creds_x509_create(
279 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
280 CLIENT_CERT_DIR);
281 g_assert(clientCreds != NULL);
282
283 serverCreds = test_tls_creds_x509_create(
284 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
285 SERVER_CERT_DIR);
286 g_assert(serverCreds != NULL);
287
288 auth = qauthz_list_new("tlssessionacl",
289 QAUTHZ_LIST_POLICY_DENY,
290 &error_abort);
291 wildcards = data->wildcards;
292 while (wildcards && *wildcards) {
293 qauthz_list_append_rule(auth, *wildcards,
294 QAUTHZ_LIST_POLICY_ALLOW,
295 QAUTHZ_LIST_FORMAT_GLOB,
296 &error_abort);
297 wildcards++;
298 }
299
300
301 clientSess = qcrypto_tls_session_new(
302 clientCreds, data->hostname, NULL,
303 QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT, &error_abort);
304 g_assert(clientSess != NULL);
305
306 serverSess = qcrypto_tls_session_new(
307 serverCreds, NULL,
308 data->wildcards ? "tlssessionacl" : NULL,
309 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER, &error_abort);
310 g_assert(serverSess != NULL);
311
312
313
314
315 qcrypto_tls_session_set_callbacks(serverSess,
316 testWrite, testRead,
317 &channel[0]);
318 qcrypto_tls_session_set_callbacks(clientSess,
319 testWrite, testRead,
320 &channel[1]);
321
322
323
324
325
326
327
328 do {
329 int rv;
330 if (!serverShake) {
331 rv = qcrypto_tls_session_handshake(serverSess,
332 &error_abort);
333 g_assert(rv >= 0);
334 if (qcrypto_tls_session_get_handshake_status(serverSess) ==
335 QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
336 serverShake = true;
337 }
338 }
339 if (!clientShake) {
340 rv = qcrypto_tls_session_handshake(clientSess,
341 &error_abort);
342 g_assert(rv >= 0);
343 if (qcrypto_tls_session_get_handshake_status(clientSess) ==
344 QCRYPTO_TLS_HANDSHAKE_COMPLETE) {
345 clientShake = true;
346 }
347 }
348 } while (!clientShake || !serverShake);
349
350
351
352
353
354 if (qcrypto_tls_session_check_credentials(
355 serverSess, data->expectServerFail ? NULL : &error_abort) < 0) {
356 g_assert(data->expectServerFail);
357 } else {
358 g_assert(!data->expectServerFail);
359 }
360
361
362
363
364 if (qcrypto_tls_session_check_credentials(
365 clientSess, data->expectClientFail ? NULL : &error_abort) < 0) {
366 g_assert(data->expectClientFail);
367 } else {
368 g_assert(!data->expectClientFail);
369 }
370
371 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
372 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
373 unlink(SERVER_CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
374
375 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CA_CERT);
376 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
377 unlink(CLIENT_CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
378
379 rmdir(CLIENT_CERT_DIR);
380 rmdir(SERVER_CERT_DIR);
381
382 object_unparent(OBJECT(serverCreds));
383 object_unparent(OBJECT(clientCreds));
384 object_unparent(OBJECT(auth));
385
386 qcrypto_tls_session_free(serverSess);
387 qcrypto_tls_session_free(clientSess);
388
389 close(channel[0]);
390 close(channel[1]);
391}
392
393
394int main(int argc, char **argv)
395{
396 int ret;
397
398 module_call_init(MODULE_INIT_QOM);
399 g_test_init(&argc, &argv, NULL);
400 setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
401
402 mkdir(WORKDIR, 0700);
403
404 test_tls_init(KEYFILE);
405 test_tls_psk_init(PSKFILE);
406
407
408 g_test_add_func("/qcrypto/tlssession/psk",
409 test_crypto_tls_session_psk);
410
411
412# define TEST_SESS_REG(name, caCrt, \
413 serverCrt, clientCrt, \
414 expectServerFail, expectClientFail, \
415 hostname, wildcards) \
416 struct QCryptoTLSSessionTestData name = { \
417 caCrt, caCrt, serverCrt, clientCrt, \
418 expectServerFail, expectClientFail, \
419 hostname, wildcards \
420 }; \
421 g_test_add_data_func("/qcrypto/tlssession/" # name, \
422 &name, test_crypto_tls_session_x509); \
423
424
425# define TEST_SESS_REG_EXT(name, serverCaCrt, clientCaCrt, \
426 serverCrt, clientCrt, \
427 expectServerFail, expectClientFail, \
428 hostname, wildcards) \
429 struct QCryptoTLSSessionTestData name = { \
430 serverCaCrt, clientCaCrt, serverCrt, clientCrt, \
431 expectServerFail, expectClientFail, \
432 hostname, wildcards \
433 }; \
434 g_test_add_data_func("/qcrypto/tlssession/" # name, \
435 &name, test_crypto_tls_session_x509); \
436
437
438
439
440 TLS_ROOT_REQ(cacertreq,
441 "UK", "qemu CA", NULL, NULL, NULL, NULL,
442 true, true, true,
443 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
444 false, false, NULL, NULL,
445 0, 0);
446
447 TLS_ROOT_REQ(altcacertreq,
448 "UK", "qemu CA 1", NULL, NULL, NULL, NULL,
449 true, true, true,
450 false, false, 0,
451 false, false, NULL, NULL,
452 0, 0);
453
454 TLS_CERT_REQ(servercertreq, cacertreq,
455 "UK", "qemu.org", NULL, NULL, NULL, NULL,
456 true, true, false,
457 true, true,
458 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
459 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
460 0, 0);
461 TLS_CERT_REQ(clientcertreq, cacertreq,
462 "UK", "qemu", NULL, NULL, NULL, NULL,
463 true, true, false,
464 true, true,
465 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
466 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
467 0, 0);
468
469 TLS_CERT_REQ(clientcertaltreq, altcacertreq,
470 "UK", "qemu", NULL, NULL, NULL, NULL,
471 true, true, false,
472 true, true,
473 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
474 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
475 0, 0);
476
477 TEST_SESS_REG(basicca, cacertreq.filename,
478 servercertreq.filename, clientcertreq.filename,
479 false, false, "qemu.org", NULL);
480 TEST_SESS_REG_EXT(differentca, cacertreq.filename,
481 altcacertreq.filename, servercertreq.filename,
482 clientcertaltreq.filename, true, true, "qemu.org", NULL);
483
484
485
486
487 TLS_CERT_REQ(servercertalt1req, cacertreq,
488 "UK", "qemu.org", "www.qemu.org", "qemu.org",
489 "192.168.122.1", "fec0::dead:beaf",
490 true, true, false,
491 true, true,
492 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
493 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
494 0, 0);
495
496 TLS_CERT_REQ(servercertalt2req, cacertreq,
497 "UK", "qemu.org", "www.qemu.org", "wiki.qemu.org",
498 "192.168.122.1", "fec0::dead:beaf",
499 true, true, false,
500 true, true,
501 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
502 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
503 0, 0);
504
505 TEST_SESS_REG(altname1, cacertreq.filename,
506 servercertalt1req.filename, clientcertreq.filename,
507 false, false, "qemu.org", NULL);
508 TEST_SESS_REG(altname2, cacertreq.filename,
509 servercertalt1req.filename, clientcertreq.filename,
510 false, false, "www.qemu.org", NULL);
511 TEST_SESS_REG(altname3, cacertreq.filename,
512 servercertalt1req.filename, clientcertreq.filename,
513 false, true, "wiki.qemu.org", NULL);
514
515 TEST_SESS_REG(altname4, cacertreq.filename,
516 servercertalt2req.filename, clientcertreq.filename,
517 false, true, "qemu.org", NULL);
518 TEST_SESS_REG(altname5, cacertreq.filename,
519 servercertalt2req.filename, clientcertreq.filename,
520 false, false, "www.qemu.org", NULL);
521 TEST_SESS_REG(altname6, cacertreq.filename,
522 servercertalt2req.filename, clientcertreq.filename,
523 false, false, "wiki.qemu.org", NULL);
524
525 const char *const wildcards1[] = {
526 "C=UK,CN=dogfood",
527 NULL,
528 };
529 const char *const wildcards2[] = {
530 "C=UK,CN=qemu",
531 NULL,
532 };
533 const char *const wildcards3[] = {
534 "C=UK,CN=dogfood",
535 "C=UK,CN=qemu",
536 NULL,
537 };
538 const char *const wildcards4[] = {
539 "C=UK,CN=qemustuff",
540 NULL,
541 };
542 const char *const wildcards5[] = {
543 "C=UK,CN=qemu*",
544 NULL,
545 };
546 const char *const wildcards6[] = {
547 "C=UK,CN=*emu*",
548 NULL,
549 };
550
551 TEST_SESS_REG(wildcard1, cacertreq.filename,
552 servercertreq.filename, clientcertreq.filename,
553 true, false, "qemu.org", wildcards1);
554 TEST_SESS_REG(wildcard2, cacertreq.filename,
555 servercertreq.filename, clientcertreq.filename,
556 false, false, "qemu.org", wildcards2);
557 TEST_SESS_REG(wildcard3, cacertreq.filename,
558 servercertreq.filename, clientcertreq.filename,
559 false, false, "qemu.org", wildcards3);
560 TEST_SESS_REG(wildcard4, cacertreq.filename,
561 servercertreq.filename, clientcertreq.filename,
562 true, false, "qemu.org", wildcards4);
563 TEST_SESS_REG(wildcard5, cacertreq.filename,
564 servercertreq.filename, clientcertreq.filename,
565 false, false, "qemu.org", wildcards5);
566 TEST_SESS_REG(wildcard6, cacertreq.filename,
567 servercertreq.filename, clientcertreq.filename,
568 false, false, "qemu.org", wildcards6);
569
570 TLS_ROOT_REQ(cacertrootreq,
571 "UK", "qemu root", NULL, NULL, NULL, NULL,
572 true, true, true,
573 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
574 false, false, NULL, NULL,
575 0, 0);
576 TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
577 "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
578 true, true, true,
579 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
580 false, false, NULL, NULL,
581 0, 0);
582 TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
583 "UK", "qemu level 1b", NULL, NULL, NULL, NULL,
584 true, true, true,
585 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
586 false, false, NULL, NULL,
587 0, 0);
588 TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
589 "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
590 true, true, true,
591 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
592 false, false, NULL, NULL,
593 0, 0);
594 TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
595 "UK", "qemu.org", NULL, NULL, NULL, NULL,
596 true, true, false,
597 true, true,
598 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
599 true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
600 0, 0);
601 TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
602 "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
603 true, true, false,
604 true, true,
605 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
606 true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
607 0, 0);
608
609 gnutls_x509_crt_t certchain[] = {
610 cacertrootreq.crt,
611 cacertlevel1areq.crt,
612 cacertlevel1breq.crt,
613 cacertlevel2areq.crt,
614 };
615
616 test_tls_write_cert_chain(WORKDIR "cacertchain-sess.pem",
617 certchain,
618 G_N_ELEMENTS(certchain));
619
620 TEST_SESS_REG(cachain, WORKDIR "cacertchain-sess.pem",
621 servercertlevel3areq.filename, clientcertlevel2breq.filename,
622 false, false, "qemu.org", NULL);
623
624 ret = g_test_run();
625
626 test_tls_discard_cert(&clientcertreq);
627 test_tls_discard_cert(&clientcertaltreq);
628
629 test_tls_discard_cert(&servercertreq);
630 test_tls_discard_cert(&servercertalt1req);
631 test_tls_discard_cert(&servercertalt2req);
632
633 test_tls_discard_cert(&cacertreq);
634 test_tls_discard_cert(&altcacertreq);
635
636 test_tls_discard_cert(&cacertrootreq);
637 test_tls_discard_cert(&cacertlevel1areq);
638 test_tls_discard_cert(&cacertlevel1breq);
639 test_tls_discard_cert(&cacertlevel2areq);
640 test_tls_discard_cert(&servercertlevel3areq);
641 test_tls_discard_cert(&clientcertlevel2breq);
642 unlink(WORKDIR "cacertchain-sess.pem");
643
644 test_tls_psk_cleanup(PSKFILE);
645 test_tls_cleanup(KEYFILE);
646 rmdir(WORKDIR);
647
648 return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
649}
650
651#else
652
653int
654main(void)
655{
656 return EXIT_SUCCESS;
657}
658
659#endif
660
