6:06 a.m.
From: "Daniel P. Berrange" <berrange(a)redhat.com>
When libvirtd starts it it will sanity check its own certs,
and before libvirt clients connect to a remote server they
will sanity check their own certs. This patch allows such
sanity checking to be skipped. There is no strong reason to
need to do this, other than to bypass possible libvirt bugs
in sanity checking, or for testing purposes.
libvirt.conf gains tls_no_sanity_certificate parameter to
go along with tls_no_verify_certificate. The remote driver
client URIs gain a no_sanity URI parameter
* daemon/test_libvirtd.aug, daemon/libvirtd.conf,
daemon/libvirtd.c, daemon/libvirtd.aug: Add parameter to
allow cert sanity checks to be skipped
* src/remote/remote_driver.c: Add no_sanity parameter to
skip cert checks
* src/rpc/virnettlscontext.c, src/rpc/virnettlscontext.h:
Add new parameter for skipping sanity checks independantly
of skipping session cert validation checks
---
daemon/libvirtd.aug | 1 +
daemon/libvirtd.c | 4 ++++
daemon/libvirtd.conf | 9 +++++++++
daemon/test_libvirtd.aug | 2 ++
src/remote/remote_driver.c | 15 +++++++++------
src/rpc/virnettlscontext.c | 36 +++++++++++++++++++++++-------------
src/rpc/virnettlscontext.h | 4 ++++
7 files changed, 52 insertions(+), 19 deletions(-)
diff --git a/daemon/libvirtd.aug b/daemon/libvirtd.aug
index 0e06142..3f47ebb 100644
--- a/daemon/libvirtd.aug
+++ b/daemon/libvirtd.aug
@@ -48,6 +48,7 @@ module Libvirtd =
| str_entry "crl_file"
let authorization_entry = bool_entry "tls_no_verify_certificate"
+ | bool_entry "tls_no_sanity_certificate"
| str_array_entry "tls_allowed_dn_list"
| str_array_entry "sasl_allowed_username_list"
diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c
index f2f3a4e..9e044e2 100644
--- a/daemon/libvirtd.c
+++ b/daemon/libvirtd.c
@@ -120,6 +120,7 @@ struct daemonConfig {
char *mdns_name;
int tls_no_verify_certificate;
+ int tls_no_sanity_certificate;
char **tls_allowed_dn_list;
char **sasl_allowed_username_list;
@@ -535,12 +536,14 @@ static int daemonSetupNetworking(virNetServerPtr srv,
config->cert_file,
config->key_file,
(const char
*const*)config->tls_allowed_dn_list,
+
config->tls_no_sanity_certificate ? false : true,
config->tls_no_verify_certificate ? false : true)))
goto error;
} else {
if (!(ctxt = virNetTLSContextNewServerPath(NULL,
!privileged,
(const char
*const*)config->tls_allowed_dn_list,
+
config->tls_no_sanity_certificate ? false : true,
config->tls_no_verify_certificate ? false : true)))
goto error;
}
@@ -1054,6 +1057,7 @@ daemonConfigLoad(struct daemonConfig *data,
GET_CONF_INT (conf, filename, mdns_adv);
GET_CONF_STR (conf, filename, mdns_name);
+ GET_CONF_INT (conf, filename, tls_no_sanity_certificate);
GET_CONF_INT (conf, filename, tls_no_verify_certificate);
GET_CONF_STR (conf, filename, key_file);
diff --git a/daemon/libvirtd.conf b/daemon/libvirtd.conf
index 3a071b0..217f2f4 100644
--- a/daemon/libvirtd.conf
+++ b/daemon/libvirtd.conf
@@ -187,6 +187,15 @@
#
+# Flag to disable verification of our own server certificates
+#
+# When libvirtd starts it performs some sanity checks against
+# its own certificates.
+#
+# Default is to always sanity. Uncommenting this will disable
+# sanity checks which is not a good idea
+#tls_no_sanity_certificate = 1
+
# Flag to disable verification of client certificates
#
# Client certificate verification is the primary authentication mechanism.
diff --git a/daemon/test_libvirtd.aug b/daemon/test_libvirtd.aug
index 5f8b644..58b7170 100644
--- a/daemon/test_libvirtd.aug
+++ b/daemon/test_libvirtd.aug
@@ -193,6 +193,7 @@ crl_file = \"/etc/pki/CA/crl.pem\"
# Default is to always verify. Uncommenting this will disable
# verification - make sure an IP whitelist is set
tls_no_verify_certificate = 1
+tls_no_sanity_certificate = 1
# A whitelist of allowed x509 Distinguished Names
@@ -468,6 +469,7 @@ audit_level = 2
{ "#comment" = "Default is to always verify. Uncommenting this
will disable" }
{ "#comment" = "verification - make sure an IP whitelist is
set" }
{ "tls_no_verify_certificate" = "1" }
+ { "tls_no_sanity_certificate" = "1" }
{ "#empty" }
{ "#empty" }
{ "#comment" = "A whitelist of allowed x509 Distinguished
Names" }
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index ec4133b..7993d50 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -351,7 +351,7 @@ doRemoteOpen (virConnectPtr conn,
*/
char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL;
char *port = NULL, *authtype = NULL, *username = NULL;
- int no_verify = 0, no_tty = 0;
+ bool sanity = true, verify = true, tty = true;
char *pkipath = NULL;
/* Return code from this function, and the private data. */
@@ -425,11 +425,14 @@ doRemoteOpen (virConnectPtr conn,
netcat = strdup (var->value);
if (!netcat) goto out_of_memory;
var->ignore = 1;
+ } else if (STRCASEEQ (var->name, "no_sanity")) {
+ sanity = atoi(var->value) == 0;
+ var->ignore = 1;
} else if (STRCASEEQ (var->name, "no_verify")) {
- no_verify = atoi (var->value);
+ verify = atoi (var->value) == 0;
var->ignore = 1;
} else if (STRCASEEQ (var->name, "no_tty")) {
- no_tty = atoi (var->value);
+ tty = atoi (var->value) == 0;
var->ignore = 1;
} else if (STRCASEEQ(var->name, "pkipath")) {
VIR_FREE(pkipath);
@@ -509,7 +512,7 @@ doRemoteOpen (virConnectPtr conn,
case trans_tls:
priv->tls = virNetTLSContextNewClientPath(pkipath,
geteuid() != 0 ? true : false,
- no_verify ? false : true);
+ sanity, verify);
if (!priv->tls)
goto failed;
priv->is_secure = 1;
@@ -579,8 +582,8 @@ doRemoteOpen (virConnectPtr conn,
port,
command,
username,
- no_tty,
- no_verify,
+ !tty,
+ !verify,
netcat ? netcat : "nc",
sockname)))
goto failed;
diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c
index 5c94df6..bde4e7a 100644
--- a/src/rpc/virnettlscontext.c
+++ b/src/rpc/virnettlscontext.c
@@ -382,7 +382,7 @@ virNetTLSContextCheckCertDN(gnutls_x509_crt_t cert,
certFile, gnutls_strerror(ret));
return -1;
}
-
+ VIR_DEBUG("Peer DN is %s", name);
if (whitelist &&
virNetTLSContextCheckCertDNWhitelist(name, whitelist) <= 0)
return -1;
@@ -637,6 +637,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert,
const char *cert,
const char *key,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert,
bool isServer)
{
@@ -644,8 +645,8 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert,
char *gnutlsdebug;
int err;
- VIR_DEBUG("cacert=%s cacrl=%s cert=%s key=%s requireValid=%d isServer=%d",
- cacert, NULLSTR(cacrl), cert, key, requireValidCert, isServer);
+ VIR_DEBUG("cacert=%s cacrl=%s cert=%s key=%s sanityCheckCert=%d requireValid=%d
isServer=%d",
+ cacert, NULLSTR(cacrl), cert, key, sanityCheckCert, requireValidCert,
isServer);
if (VIR_ALLOC(ctxt) < 0) {
virReportOOMError();
@@ -675,7 +676,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert,
goto error;
}
- if (requireValidCert &&
+ if (sanityCheckCert &&
virNetTLSContextSanityCheckCredentials(isServer, cacert, cert) < 0)
goto error;
@@ -851,6 +852,7 @@ out_of_memory:
static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath,
bool tryUserPkiPath,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert,
bool isServer)
{
@@ -862,7 +864,8 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char
*pkipath,
return NULL;
ctxt = virNetTLSContextNew(cacert, cacrl, cert, key,
- x509dnWhitelist, requireValidCert, isServer);
+ x509dnWhitelist, sanityCheckCert,
+ requireValidCert, isServer);
VIR_FREE(cacert);
VIR_FREE(cacrl);
@@ -875,18 +878,20 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char
*pkipath,
virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath,
bool tryUserPkiPath,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert)
{
- return virNetTLSContextNewPath(pkipath, tryUserPkiPath,
- x509dnWhitelist, requireValidCert, true);
+ return virNetTLSContextNewPath(pkipath, tryUserPkiPath, x509dnWhitelist,
+ sanityCheckCert, requireValidCert, true);
}
virNetTLSContextPtr virNetTLSContextNewClientPath(const char *pkipath,
bool tryUserPkiPath,
+ bool sanityCheckCert,
bool requireValidCert)
{
- return virNetTLSContextNewPath(pkipath, tryUserPkiPath,
- NULL, requireValidCert, false);
+ return virNetTLSContextNewPath(pkipath, tryUserPkiPath, NULL,
+ sanityCheckCert, requireValidCert, false);
}
@@ -895,10 +900,11 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert,
const char *cert,
const char *key,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert)
{
- return virNetTLSContextNew(cacert, cacrl, cert, key,
- x509dnWhitelist, requireValidCert, true);
+ return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist,
+ sanityCheckCert, requireValidCert, true);
}
@@ -906,10 +912,11 @@ virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
+ bool sanityCheckCert,
bool requireValidCert)
{
- return virNetTLSContextNew(cacert, cacrl, key, cert,
- NULL, requireValidCert, false);
+ return virNetTLSContextNew(cacert, cacrl, cert, key, NULL,
+ sanityCheckCert, requireValidCert, false);
}
@@ -1047,11 +1054,14 @@ int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt,
virNetTLSSessionPtr sess)
{
if (virNetTLSContextValidCertificate(ctxt, sess) < 0) {
+ virErrorPtr err = virGetLastError();
+ VIR_WARN("Certificate check failed %s", err && err->message
? err->message : "<unknown>");
if (ctxt->requireValidCert) {
virNetError(VIR_ERR_AUTH_FAILED, "%s",
_("Failed to verify peer's certificate"));
return -1;
}
+ virResetLastError();
VIR_INFO("Ignoring bad certificate at user request");
}
return 0;
diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h
index f23667f..641d67e 100644
--- a/src/rpc/virnettlscontext.h
+++ b/src/rpc/virnettlscontext.h
@@ -33,10 +33,12 @@ typedef virNetTLSSession *virNetTLSSessionPtr;
virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath,
bool tryUserPkiPath,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert);
virNetTLSContextPtr virNetTLSContextNewClientPath(const char *pkipath,
bool tryUserPkiPath,
+ bool sanityCheckCert,
bool requireValidCert);
virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert,
@@ -44,12 +46,14 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert,
const char *cert,
const char *key,
const char *const*x509dnWhitelist,
+ bool sanityCheckCert,
bool requireValidCert);
virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert,
const char *cacrl,
const char *cert,
const char *key,
+ bool sanityCheckCert,
bool requireValidCert);
void virNetTLSContextRef(virNetTLSContextPtr ctxt);
--
1.7.6
6:06 a.m.
New subject: [libvirt] [PATCH 2/2] Add a test case for certificate validation
From: "Daniel P. Berrange" <berrange(a)redhat.com>
This test case checks certification validation rules for
- Basic constraints
- Key purpose
- Key usage
- Start/expiry times
It checks initial context creation sanity checks, and live
session validation
---
tests/.gitignore | 1 +
tests/Makefile.am | 8 +-
tests/pkix_asn1_tab.c | 567 +++++++++++++++++++
tests/virnettlscontexttest.c | 1246 ++++++++++++++++++++++++++++++++++++++++++
4 files changed, 1821 insertions(+), 1 deletions(-)
create mode 100644 tests/pkix_asn1_tab.c
create mode 100644 tests/virnettlscontexttest.c
diff --git a/tests/.gitignore b/tests/.gitignore
index 32457ab..7159c37 100644
--- a/tests/.gitignore
+++ b/tests/.gitignore
@@ -34,6 +34,7 @@ utiltest
virbuftest
virnetmessagetest
virnetsockettest
+virnettlscontexttest
virshtest
vmx2xmltest
xencapstest
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 971ab70..1c91a1e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -85,7 +85,7 @@ check_PROGRAMS = virshtest conftest sockettest \
nodeinfotest qparamtest virbuftest \
commandtest commandhelper seclabeltest \
hashtest virnetmessagetest virnetsockettest ssh \
- utiltest
+ utiltest virnettlscontexttest
# This is a fake SSH we use from virnetsockettest
ssh_SOURCES = ssh.c
@@ -202,6 +202,7 @@ TESTS = virshtest \
hashtest \
virnetmessagetest \
virnetsockettest \
+ virnettlscontexttest \
utiltest \
$(test_scripts)
@@ -452,6 +453,11 @@ virnetsockettest_SOURCES = \
virnetsockettest_CFLAGS = -Dabs_builddir="\"$(abs_builddir)\""
$(AM_CFLAGS)
virnetsockettest_LDADD = ../src/libvirt-net-rpc.la $(LDADDS)
+virnettlscontexttest_SOURCES = \
+ virnettlscontexttest.c testutils.h testutils.c pkix_asn1_tab.c
+virnettlscontexttest_CFLAGS = -Dabs_builddir="\"$(abs_builddir)\""
$(AM_CFLAGS)
+virnettlscontexttest_LDADD = ../src/libvirt-net-rpc.la $(LDADDS) -ltasn1
+
seclabeltest_SOURCES = \
seclabeltest.c
diff --git a/tests/pkix_asn1_tab.c b/tests/pkix_asn1_tab.c
new file mode 100644
index 0000000..5d5ca3d
--- /dev/null
+++ b/tests/pkix_asn1_tab.c
@@ -0,0 +1,567 @@
+/*
+ * This file comes from gnutls, licensed under the GPLv3+
+ */
+
+#include <config.h>
+#include <libtasn1.h>
+
+const ASN1_ARRAY_TYPE pkix_asn1_tab[] = {
+ { "PKIX1", 536875024, NULL },
+ { NULL, 1073741836, NULL },
+ { "id-pkix", 1879048204, NULL },
+ { "iso", 1073741825, "1"},
+ { "identified-organization", 1073741825, "3"},
+ { "dod", 1073741825, "6"},
+ { "internet", 1073741825, "1"},
+ { "security", 1073741825, "5"},
+ { "mechanisms", 1073741825, "5"},
+ { "pkix", 1, "7"},
+ { "AuthorityKeyIdentifier", 1610612741, NULL },
+ { "keyIdentifier", 1610637314, "KeyIdentifier"},
+ { NULL, 4104, "0"},
+ { "authorityCertIssuer", 1610637314, "GeneralNames"},
+ { NULL, 4104, "1"},
+ { "authorityCertSerialNumber", 536895490,
"CertificateSerialNumber"},
+ { NULL, 4104, "2"},
+ { "KeyIdentifier", 1073741831, NULL },
+ { "SubjectKeyIdentifier", 1073741826, "KeyIdentifier"},
+ { "KeyUsage", 1073741830, NULL },
+ { "DirectoryString", 1610612754, NULL },
+ { "teletexString", 1612709890, "TeletexString"},
+ { "MAX", 524298, "1"},
+ { "printableString", 1612709890, "PrintableString"},
+ { "MAX", 524298, "1"},
+ { "universalString", 1612709890, "UniversalString"},
+ { "MAX", 524298, "1"},
+ { "utf8String", 1612709890, "UTF8String"},
+ { "MAX", 524298, "1"},
+ { "bmpString", 1612709890, "BMPString"},
+ { "MAX", 524298, "1"},
+ { "ia5String", 538968066, "IA5String"},
+ { "MAX", 524298, "1"},
+ { "SubjectAltName", 1073741826, "GeneralNames"},
+ { "GeneralNames", 1612709899, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "GeneralName"},
+ { "GeneralName", 1610612754, NULL },
+ { "otherName", 1610620930, "AnotherName"},
+ { NULL, 4104, "0"},
+ { "rfc822Name", 1610620930, "IA5String"},
+ { NULL, 4104, "1"},
+ { "dNSName", 1610620930, "IA5String"},
+ { NULL, 4104, "2"},
+ { "x400Address", 1610620941, NULL },
+ { NULL, 4104, "3"},
+ { "directoryName", 1610620930, "RDNSequence"},
+ { NULL, 2056, "4"},
+ { "ediPartyName", 1610620941, NULL },
+ { NULL, 4104, "5"},
+ { "uniformResourceIdentifier", 1610620930, "IA5String"},
+ { NULL, 4104, "6"},
+ { "iPAddress", 1610620935, NULL },
+ { NULL, 4104, "7"},
+ { "registeredID", 536879116, NULL },
+ { NULL, 4104, "8"},
+ { "AnotherName", 1610612741, NULL },
+ { "type-id", 1073741836, NULL },
+ { "value", 541073421, NULL },
+ { NULL, 1073743880, "0"},
+ { "type-id", 1, NULL },
+ { "IssuerAltName", 1073741826, "GeneralNames"},
+ { "BasicConstraints", 1610612741, NULL },
+ { "cA", 1610645508, NULL },
+ { NULL, 131081, NULL },
+ { "pathLenConstraint", 537411587, NULL },
+ { "0", 10, "MAX"},
+ { "CRLDistributionPoints", 1612709899, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "DistributionPoint"},
+ { "DistributionPoint", 1610612741, NULL },
+ { "distributionPoint", 1610637314, "DistributionPointName"},
+ { NULL, 2056, "0"},
+ { "reasons", 1610637314, "ReasonFlags"},
+ { NULL, 4104, "1"},
+ { "cRLIssuer", 536895490, "GeneralNames"},
+ { NULL, 4104, "2"},
+ { "DistributionPointName", 1610612754, NULL },
+ { "fullName", 1610620930, "GeneralNames"},
+ { NULL, 4104, "0"},
+ { "nameRelativeToCRLIssuer", 536879106,
"RelativeDistinguishedName"},
+ { NULL, 4104, "1"},
+ { "ReasonFlags", 1073741830, NULL },
+ { "ExtKeyUsageSyntax", 1612709899, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "KeyPurposeId"},
+ { "KeyPurposeId", 1073741836, NULL },
+ { "CRLNumber", 1611137027, NULL },
+ { "0", 10, "MAX"},
+ { "CertificateIssuer", 1073741826, "GeneralNames"},
+ { "NumericString", 1610620935, NULL },
+ { NULL, 4360, "18"},
+ { "IA5String", 1610620935, NULL },
+ { NULL, 4360, "22"},
+ { "TeletexString", 1610620935, NULL },
+ { NULL, 4360, "20"},
+ { "PrintableString", 1610620935, NULL },
+ { NULL, 4360, "19"},
+ { "UniversalString", 1610620935, NULL },
+ { NULL, 4360, "28"},
+ { "BMPString", 1610620935, NULL },
+ { NULL, 4360, "30"},
+ { "UTF8String", 1610620935, NULL },
+ { NULL, 4360, "12"},
+ { "Attribute", 1610612741, NULL },
+ { "type", 1073741826, "AttributeType"},
+ { "values", 536870927, NULL },
+ { NULL, 2, "AttributeValue"},
+ { "AttributeType", 1073741836, NULL },
+ { "AttributeValue", 1614807053, NULL },
+ { "type", 1, NULL },
+ { "AttributeTypeAndValue", 1610612741, NULL },
+ { "type", 1073741826, "AttributeType"},
+ { "value", 2, "AttributeValue"},
+ { "id-at", 1879048204, NULL },
+ { "joint-iso-ccitt", 1073741825, "2"},
+ { "ds", 1073741825, "5"},
+ { NULL, 1, "4"},
+ { "id-at-initials", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "43"},
+ { "X520initials", 1073741826, "DirectoryString"},
+ { "id-at-generationQualifier", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "44"},
+ { "X520generationQualifier", 1073741826, "DirectoryString"},
+ { "id-at-surname", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "4"},
+ { "X520surName", 1073741826, "DirectoryString"},
+ { "id-at-givenName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "42"},
+ { "X520givenName", 1073741826, "DirectoryString"},
+ { "id-at-name", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "41"},
+ { "X520name", 1073741826, "DirectoryString"},
+ { "id-at-commonName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "3"},
+ { "X520CommonName", 1073741826, "DirectoryString"},
+ { "id-at-localityName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "7"},
+ { "X520LocalityName", 1073741826, "DirectoryString"},
+ { "id-at-stateOrProvinceName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "8"},
+ { "X520StateOrProvinceName", 1073741826, "DirectoryString"},
+ { "id-at-organizationName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "10"},
+ { "X520OrganizationName", 1073741826, "DirectoryString"},
+ { "id-at-organizationalUnitName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "11"},
+ { "X520OrganizationalUnitName", 1073741826, "DirectoryString"},
+ { "id-at-title", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "12"},
+ { "X520Title", 1073741826, "DirectoryString"},
+ { "id-at-description", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "13"},
+ { "X520Description", 1073741826, "DirectoryString"},
+ { "id-at-dnQualifier", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "46"},
+ { "X520dnQualifier", 1073741826, "PrintableString"},
+ { "id-at-countryName", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "6"},
+ { "X520countryName", 1612709890, "PrintableString"},
+ { NULL, 1048586, "2"},
+ { "id-at-serialNumber", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "5"},
+ { "X520serialNumber", 1073741826, "PrintableString"},
+ { "id-at-telephoneNumber", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "20"},
+ { "X520telephoneNumber", 1073741826, "PrintableString"},
+ { "id-at-facsimileTelephoneNumber", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "23"},
+ { "X520facsimileTelephoneNumber", 1073741826, "PrintableString"},
+ { "id-at-pseudonym", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "65"},
+ { "X520pseudonym", 1073741826, "DirectoryString"},
+ { "id-at-name", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "41"},
+ { "X520name", 1073741826, "DirectoryString"},
+ { "id-at-streetAddress", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "9"},
+ { "X520streetAddress", 1073741826, "DirectoryString"},
+ { "id-at-postalAddress", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "16"},
+ { "X520postalAddress", 1073741826, "PostalAddress"},
+ { "PostalAddress", 1610612747, NULL },
+ { NULL, 2, "DirectoryString"},
+ { "id-at-postalCode", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-at"},
+ { NULL, 1, "17"},
+ { "X520postalCode", 1073741826, "DirectoryString"},
+ { "emailAddress", 1880096780, "AttributeType"},
+ { "iso", 1073741825, "1"},
+ { "member-body", 1073741825, "2"},
+ { "us", 1073741825, "840"},
+ { "rsadsi", 1073741825, "113549"},
+ { "pkcs", 1073741825, "1"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "1"},
+ { "Pkcs9email", 1612709890, "IA5String"},
+ { "ub-emailaddress-length", 524298, "1"},
+ { "Name", 1610612754, NULL },
+ { "rdnSequence", 2, "RDNSequence"},
+ { "RDNSequence", 1610612747, NULL },
+ { NULL, 2, "RelativeDistinguishedName"},
+ { "DistinguishedName", 1073741826, "RDNSequence"},
+ { "RelativeDistinguishedName", 1612709903, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "AttributeTypeAndValue"},
+ { "Certificate", 1610612741, NULL },
+ { "tbsCertificate", 1073741826, "TBSCertificate"},
+ { "signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+ { "signature", 6, NULL },
+ { "TBSCertificate", 1610612741, NULL },
+ { "version", 1610653698, "Version"},
+ { NULL, 1073741833, "v1"},
+ { NULL, 2056, "0"},
+ { "serialNumber", 1073741826, "CertificateSerialNumber"},
+ { "signature", 1073741826, "AlgorithmIdentifier"},
+ { "issuer", 1073741826, "Name"},
+ { "validity", 1073741826, "Validity"},
+ { "subject", 1073741826, "Name"},
+ { "subjectPublicKeyInfo", 1073741826, "SubjectPublicKeyInfo"},
+ { "issuerUniqueID", 1610637314, "UniqueIdentifier"},
+ { NULL, 4104, "1"},
+ { "subjectUniqueID", 1610637314, "UniqueIdentifier"},
+ { NULL, 4104, "2"},
+ { "extensions", 536895490, "Extensions"},
+ { NULL, 2056, "3"},
+ { "Version", 1610874883, NULL },
+ { "v1", 1073741825, "0"},
+ { "v2", 1073741825, "1"},
+ { "v3", 1, "2"},
+ { "CertificateSerialNumber", 1073741827, NULL },
+ { "Validity", 1610612741, NULL },
+ { "notBefore", 1073741826, "Time"},
+ { "notAfter", 2, "Time"},
+ { "Time", 1610612754, NULL },
+ { "utcTime", 1090519057, NULL },
+ { "generalTime", 8388625, NULL },
+ { "UniqueIdentifier", 1073741830, NULL },
+ { "SubjectPublicKeyInfo", 1610612741, NULL },
+ { "algorithm", 1073741826, "AlgorithmIdentifier"},
+ { "subjectPublicKey", 6, NULL },
+ { "Extensions", 1612709899, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "Extension"},
+ { "Extension", 1610612741, NULL },
+ { "extnID", 1073741836, NULL },
+ { "critical", 1610645508, NULL },
+ { NULL, 131081, NULL },
+ { "extnValue", 7, NULL },
+ { "CertificateList", 1610612741, NULL },
+ { "tbsCertList", 1073741826, "TBSCertList"},
+ { "signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+ { "signature", 6, NULL },
+ { "TBSCertList", 1610612741, NULL },
+ { "version", 1073758210, "Version"},
+ { "signature", 1073741826, "AlgorithmIdentifier"},
+ { "issuer", 1073741826, "Name"},
+ { "thisUpdate", 1073741826, "Time"},
+ { "nextUpdate", 1073758210, "Time"},
+ { "revokedCertificates", 1610629131, NULL },
+ { NULL, 536870917, NULL },
+ { "userCertificate", 1073741826, "CertificateSerialNumber"},
+ { "revocationDate", 1073741826, "Time"},
+ { "crlEntryExtensions", 16386, "Extensions"},
+ { "crlExtensions", 536895490, "Extensions"},
+ { NULL, 2056, "0"},
+ { "AlgorithmIdentifier", 1610612741, NULL },
+ { "algorithm", 1073741836, NULL },
+ { "parameters", 541081613, NULL },
+ { "algorithm", 1, NULL },
+ { "Dss-Sig-Value", 1610612741, NULL },
+ { "r", 1073741827, NULL },
+ { "s", 3, NULL },
+ { "DomainParameters", 1610612741, NULL },
+ { "p", 1073741827, NULL },
+ { "g", 1073741827, NULL },
+ { "q", 1073741827, NULL },
+ { "j", 1073758211, NULL },
+ { "validationParms", 16386, "ValidationParms"},
+ { "ValidationParms", 1610612741, NULL },
+ { "seed", 1073741830, NULL },
+ { "pgenCounter", 3, NULL },
+ { "Dss-Parms", 1610612741, NULL },
+ { "p", 1073741827, NULL },
+ { "q", 1073741827, NULL },
+ { "g", 3, NULL },
+ { "CountryName", 1610620946, NULL },
+ { NULL, 1073746952, "1"},
+ { "x121-dcc-code", 1612709890, "NumericString"},
+ { NULL, 1048586, "ub-country-name-numeric-length"},
+ { "iso-3166-alpha2-code", 538968066, "PrintableString"},
+ { NULL, 1048586, "ub-country-name-alpha-length"},
+ { "OrganizationName", 1612709890, "PrintableString"},
+ { "ub-organization-name-length", 524298, "1"},
+ { "NumericUserIdentifier", 1612709890, "NumericString"},
+ { "ub-numeric-user-id-length", 524298, "1"},
+ { "OrganizationalUnitNames", 1612709899, NULL },
+ { "ub-organizational-units", 1074266122, "1"},
+ { NULL, 2, "OrganizationalUnitName"},
+ { "OrganizationalUnitName", 1612709890, "PrintableString"},
+ { "ub-organizational-unit-name-length", 524298, "1"},
+ { "CommonName", 1073741826, "PrintableString"},
+ { "pkcs-7-ContentInfo", 1610612741, NULL },
+ { "contentType", 1073741826, "pkcs-7-ContentType"},
+ { "content", 541073421, NULL },
+ { NULL, 1073743880, "0"},
+ { "contentType", 1, NULL },
+ { "pkcs-7-DigestInfo", 1610612741, NULL },
+ { "digestAlgorithm", 1073741826,
"pkcs-7-DigestAlgorithmIdentifier"},
+ { "digest", 2, "pkcs-7-Digest"},
+ { "pkcs-7-Digest", 1073741831, NULL },
+ { "pkcs-7-ContentType", 1073741836, NULL },
+ { "pkcs-7-SignedData", 1610612741, NULL },
+ { "version", 1073741826, "pkcs-7-CMSVersion"},
+ { "digestAlgorithms", 1073741826,
"pkcs-7-DigestAlgorithmIdentifiers"},
+ { "encapContentInfo", 1073741826,
"pkcs-7-EncapsulatedContentInfo"},
+ { "certificates", 1610637314, "pkcs-7-CertificateSet"},
+ { NULL, 4104, "0"},
+ { "crls", 1610637314, "pkcs-7-CertificateRevocationLists"},
+ { NULL, 4104, "1"},
+ { "signerInfos", 2, "pkcs-7-SignerInfos"},
+ { "pkcs-7-CMSVersion", 1610874883, NULL },
+ { "v0", 1073741825, "0"},
+ { "v1", 1073741825, "1"},
+ { "v2", 1073741825, "2"},
+ { "v3", 1073741825, "3"},
+ { "v4", 1, "4"},
+ { "pkcs-7-DigestAlgorithmIdentifiers", 1610612751, NULL },
+ { NULL, 2, "pkcs-7-DigestAlgorithmIdentifier"},
+ { "pkcs-7-DigestAlgorithmIdentifier", 1073741826,
"AlgorithmIdentifier"},
+ { "pkcs-7-EncapsulatedContentInfo", 1610612741, NULL },
+ { "eContentType", 1073741826, "pkcs-7-ContentType"},
+ { "eContent", 536895495, NULL },
+ { NULL, 2056, "0"},
+ { "pkcs-7-CertificateRevocationLists", 1610612751, NULL },
+ { NULL, 13, NULL },
+ { "pkcs-7-CertificateChoices", 1610612754, NULL },
+ { "certificate", 13, NULL },
+ { "pkcs-7-CertificateSet", 1610612751, NULL },
+ { NULL, 2, "pkcs-7-CertificateChoices"},
+ { "pkcs-7-SignerInfos", 1610612751, NULL },
+ { NULL, 13, NULL },
+ { "pkcs-10-CertificationRequestInfo", 1610612741, NULL },
+ { "version", 1610874883, NULL },
+ { "v1", 1, "0"},
+ { "subject", 1073741826, "Name"},
+ { "subjectPKInfo", 1073741826, "SubjectPublicKeyInfo"},
+ { "attributes", 536879106, "Attributes"},
+ { NULL, 4104, "0"},
+ { "Attributes", 1610612751, NULL },
+ { NULL, 2, "Attribute"},
+ { "pkcs-10-CertificationRequest", 1610612741, NULL },
+ { "certificationRequestInfo", 1073741826,
"pkcs-10-CertificationRequestInfo"},
+ { "signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+ { "signature", 6, NULL },
+ { "pkcs-9-at-challengePassword", 1879048204, NULL },
+ { "iso", 1073741825, "1"},
+ { "member-body", 1073741825, "2"},
+ { "us", 1073741825, "840"},
+ { "rsadsi", 1073741825, "113549"},
+ { "pkcs", 1073741825, "1"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "7"},
+ { "pkcs-9-challengePassword", 1610612754, NULL },
+ { "printableString", 1073741826, "PrintableString"},
+ { "utf8String", 2, "UTF8String"},
+ { "pkcs-9-at-localKeyId", 1879048204, NULL },
+ { "iso", 1073741825, "1"},
+ { "member-body", 1073741825, "2"},
+ { "us", 1073741825, "840"},
+ { "rsadsi", 1073741825, "113549"},
+ { "pkcs", 1073741825, "1"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "21"},
+ { "pkcs-9-localKeyId", 1073741831, NULL },
+ { "pkcs-9-at-friendlyName", 1879048204, NULL },
+ { "iso", 1073741825, "1"},
+ { "member-body", 1073741825, "2"},
+ { "us", 1073741825, "840"},
+ { "rsadsi", 1073741825, "113549"},
+ { "pkcs", 1073741825, "1"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "20"},
+ { "pkcs-9-friendlyName", 1612709890, "BMPString"},
+ { "255", 524298, "1"},
+ { "pkcs-8-PrivateKeyInfo", 1610612741, NULL },
+ { "version", 1073741826, "pkcs-8-Version"},
+ { "privateKeyAlgorithm", 1073741826, "AlgorithmIdentifier"},
+ { "privateKey", 1073741826, "pkcs-8-PrivateKey"},
+ { "attributes", 536895490, "Attributes"},
+ { NULL, 4104, "0"},
+ { "pkcs-8-Version", 1610874883, NULL },
+ { "v1", 1, "0"},
+ { "pkcs-8-PrivateKey", 1073741831, NULL },
+ { "pkcs-8-Attributes", 1610612751, NULL },
+ { NULL, 2, "Attribute"},
+ { "pkcs-8-EncryptedPrivateKeyInfo", 1610612741, NULL },
+ { "encryptionAlgorithm", 1073741826, "AlgorithmIdentifier"},
+ { "encryptedData", 2, "pkcs-8-EncryptedData"},
+ { "pkcs-8-EncryptedData", 1073741831, NULL },
+ { "pkcs-5-des-EDE3-CBC-params", 1612709895, NULL },
+ { NULL, 1048586, "8"},
+ { "pkcs-5-aes128-CBC-params", 1612709895, NULL },
+ { NULL, 1048586, "16"},
+ { "pkcs-5-aes192-CBC-params", 1612709895, NULL },
+ { NULL, 1048586, "16"},
+ { "pkcs-5-aes256-CBC-params", 1612709895, NULL },
+ { NULL, 1048586, "16"},
+ { "pkcs-5-PBES2-params", 1610612741, NULL },
+ { "keyDerivationFunc", 1073741826, "AlgorithmIdentifier"},
+ { "encryptionScheme", 2, "AlgorithmIdentifier"},
+ { "pkcs-5-PBKDF2-params", 1610612741, NULL },
+ { "salt", 1610612754, NULL },
+ { "specified", 1073741831, NULL },
+ { "otherSource", 2, "AlgorithmIdentifier"},
+ { "iterationCount", 1611137027, NULL },
+ { "1", 10, "MAX"},
+ { "keyLength", 1611153411, NULL },
+ { "1", 10, "MAX"},
+ { "prf", 16386, "AlgorithmIdentifier"},
+ { "pkcs-12-PFX", 1610612741, NULL },
+ { "version", 1610874883, NULL },
+ { "v3", 1, "3"},
+ { "authSafe", 1073741826, "pkcs-7-ContentInfo"},
+ { "macData", 16386, "pkcs-12-MacData"},
+ { "pkcs-12-PbeParams", 1610612741, NULL },
+ { "salt", 1073741831, NULL },
+ { "iterations", 3, NULL },
+ { "pkcs-12-MacData", 1610612741, NULL },
+ { "mac", 1073741826, "pkcs-7-DigestInfo"},
+ { "macSalt", 1073741831, NULL },
+ { "iterations", 536903683, NULL },
+ { NULL, 9, "1"},
+ { "pkcs-12-AuthenticatedSafe", 1610612747, NULL },
+ { NULL, 2, "pkcs-7-ContentInfo"},
+ { "pkcs-12-SafeContents", 1610612747, NULL },
+ { NULL, 2, "pkcs-12-SafeBag"},
+ { "pkcs-12-SafeBag", 1610612741, NULL },
+ { "bagId", 1073741836, NULL },
+ { "bagValue", 1614815245, NULL },
+ { NULL, 1073743880, "0"},
+ { "badId", 1, NULL },
+ { "bagAttributes", 536887311, NULL },
+ { NULL, 2, "pkcs-12-PKCS12Attribute"},
+ { "pkcs-12-KeyBag", 1073741826, "pkcs-8-PrivateKeyInfo"},
+ { "pkcs-12-PKCS8ShroudedKeyBag", 1073741826,
"pkcs-8-EncryptedPrivateKeyInfo"},
+ { "pkcs-12-CertBag", 1610612741, NULL },
+ { "certId", 1073741836, NULL },
+ { "certValue", 541073421, NULL },
+ { NULL, 1073743880, "0"},
+ { "certId", 1, NULL },
+ { "pkcs-12-CRLBag", 1610612741, NULL },
+ { "crlId", 1073741836, NULL },
+ { "crlValue", 541073421, NULL },
+ { NULL, 1073743880, "0"},
+ { "crlId", 1, NULL },
+ { "pkcs-12-SecretBag", 1610612741, NULL },
+ { "secretTypeId", 1073741836, NULL },
+ { "secretValue", 541073421, NULL },
+ { NULL, 1073743880, "0"},
+ { "secretTypeId", 1, NULL },
+ { "pkcs-12-PKCS12Attribute", 1073741826, "Attribute"},
+ { "pkcs-7-Data", 1073741831, NULL },
+ { "pkcs-7-EncryptedData", 1610612741, NULL },
+ { "version", 1073741826, "pkcs-7-CMSVersion"},
+ { "encryptedContentInfo", 1073741826,
"pkcs-7-EncryptedContentInfo"},
+ { "unprotectedAttrs", 536895490, "pkcs-7-UnprotectedAttributes"},
+ { NULL, 4104, "1"},
+ { "pkcs-7-EncryptedContentInfo", 1610612741, NULL },
+ { "contentType", 1073741826, "pkcs-7-ContentType"},
+ { "contentEncryptionAlgorithm", 1073741826,
"pkcs-7-ContentEncryptionAlgorithmIdentifier"},
+ { "encryptedContent", 536895490, "pkcs-7-EncryptedContent"},
+ { NULL, 4104, "0"},
+ { "pkcs-7-ContentEncryptionAlgorithmIdentifier", 1073741826,
"AlgorithmIdentifier"},
+ { "pkcs-7-EncryptedContent", 1073741831, NULL },
+ { "pkcs-7-UnprotectedAttributes", 1612709903, NULL },
+ { "MAX", 1074266122, "1"},
+ { NULL, 2, "Attribute"},
+ { "id-at-ldap-DC", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "0"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1073741825, "2342"},
+ { NULL, 1073741825, "19200300"},
+ { NULL, 1073741825, "100"},
+ { NULL, 1073741825, "1"},
+ { NULL, 1, "25"},
+ { "ldap-DC", 1073741826, "IA5String"},
+ { "id-at-ldap-UID", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "0"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1073741825, "2342"},
+ { NULL, 1073741825, "19200300"},
+ { NULL, 1073741825, "100"},
+ { NULL, 1073741825, "1"},
+ { NULL, 1, "1"},
+ { "ldap-UID", 1073741826, "DirectoryString"},
+ { "id-pda-dateOfBirth", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "1"},
+ { "DateOfBirth", 1082130449, NULL },
+ { "id-pda-placeOfBirth", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "2"},
+ { "PlaceOfBirth", 1073741826, "DirectoryString"},
+ { "id-pda-gender", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "3"},
+ { "Gender", 1612709890, "PrintableString"},
+ { NULL, 1048586, "1"},
+ { "id-pda-countryOfCitizenship", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "4"},
+ { "CountryOfCitizenship", 1612709890, "PrintableString"},
+ { NULL, 1048586, "2"},
+ { "id-pda-countryOfResidence", 1880096780, "AttributeType"},
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "9"},
+ { NULL, 1, "5"},
+ { "CountryOfResidence", 1612709890, "PrintableString"},
+ { NULL, 1048586, "2"},
+ { "ProxyCertInfo", 1610612741, NULL },
+ { "pCPathLenConstraint", 1611153411, NULL },
+ { "0", 10, "MAX"},
+ { "proxyPolicy", 2, "ProxyPolicy"},
+ { "ProxyPolicy", 1610612741, NULL },
+ { "policyLanguage", 1073741836, NULL },
+ { "policy", 16391, NULL },
+ { "id-on-xmppAddr", 1879048204, NULL },
+ { NULL, 1073741825, "id-pkix"},
+ { NULL, 1073741825, "8"},
+ { NULL, 1, "5"},
+ { "XmppAddr", 2, "UTF8String"},
+ { NULL, 0, NULL }
+};
diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
new file mode 100644
index 0000000..7110325
--- /dev/null
+++ b/tests/virnettlscontexttest.c
@@ -0,0 +1,1246 @@
+/*
+ * Copyright (C) 2011 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Author: Daniel P. Berrange <berrange(a)redhat.com>
+ */
+
+#include <config.h>
+
+#include <stdlib.h>
+#include <signal.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+
+#include "testutils.h"
+#include "util.h"
+#include "virterror_internal.h"
+#include "memory.h"
+#include "logging.h"
+#include "virfile.h"
+#include "command.h"
+#include "network.h"
+
+#ifndef WIN32
+#include <libtasn1.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include "gnutls_1_0_compat.h"
+
+#include "rpc/virnettlscontext.h"
+
+#define VIR_FROM_THIS VIR_FROM_RPC
+
+const char *keyfile = abs_builddir "/virnettlscontexttest-key.pem";
+
+/*
+ * These store some static data that is needed when
+ * encoding extensions in the x509 certs
+ */
+ASN1_TYPE pkix_asn1;
+extern const ASN1_ARRAY_TYPE pkix_asn1_tab[];
+
+/*
+ * To avoid consuming random entropy to generate keys,
+ * here's one we prepared earlier :-)
+ */
+gnutls_x509_privkey_t privkey;
+#define PRIVATE_KEY \
+ "-----BEGIN PRIVATE KEY-----\n" \
+ "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALVcr" \
+ "BL40Tm6yq88FBhJNw1aaoCjmtg0l4dWQZ/e9Fimx4ARxFpT+ji4FE" \
+ "Cgl9s/SGqC+1nvlkm9ViSo0j7MKDbnDB+VRHDvMAzQhA2X7e8M0n9" \
+ "rPolUY2lIVC83q0BBaOBkCj2RSmT2xTEbbC2xLukSrg2WP/ihVOxc" \
+ "kXRuyFtzAgMBAAECgYB7slBexDwXrtItAMIH6m/U+LUpNe0Xx48OL" \
+ "IOn4a4whNgO/o84uIwygUK27ZGFZT0kAGAk8CdF9hA6ArcbQ62s1H" \
+ "myxrUbF9/mrLsQw1NEqpuUk9Ay2Tx5U/wPx35S3W/X2AvR/ZpTnCn" \
+ "2q/7ym9fyiSoj86drD7BTvmKXlOnOwQJBAPOFMp4mMa9NGpGuEssO" \
+ "m3Uwbp6lhcP0cA9MK+iOmeANpoKWfBdk5O34VbmeXnGYWEkrnX+9J" \
+ "bM4wVhnnBWtgBMCQQC+qAEmvwcfhauERKYznMVUVksyeuhxhCe7EK" \
+ "mPh+U2+g0WwdKvGDgO0PPt1gq0ILEjspMDeMHVdTwkaVBo/uMhAkA" \
+ "Z5SsZyCP2aTOPFDypXRdI4eqRcjaEPOUBq27r3uYb/jeboVb2weLa" \
+ "L1MmVuHiIHoa5clswPdWVI2y0em2IGoDAkBPSp/v9VKJEZabk9Frd" \
+ "a+7u4fanrM9QrEjY3KhduslSilXZZSxrWjjAJPyPiqFb3M8XXA26W" \
+ "nz1KYGnqYKhLcBAkB7dt57n9xfrhDpuyVEv+Uv1D3VVAhZlsaZ5Pp" \
+ "dcrhrkJn2sa/+O8OKvdrPSeeu/N5WwYhJf61+CPoenMp7IFci\n" \
+ "-----END PRIVATE KEY-----\n"
+
+
+/*
+ * This contains parameter about how to generate
+ * certificates.
+ */
+struct testTLSCertReq {
+ gnutls_x509_crt_t crt;
+ gnutls_x509_crt_t cacrt; /* If not set, then the cert will be self-signed */
+
+ const char *filename;
+
+ /* Identifying information */
+ const char *country;
+ const char *cn;
+ const char *altname1;
+ const char *altname2;
+ const char *ipaddr1;
+ const char *ipaddr2;
+
+ /* Basic constraints */
+ bool basicConstraintsEnable;
+ bool basicConstraintsCritical;
+ bool basicConstraintsIsCA;
+
+ /* Key usage */
+ bool keyUsageEnable;
+ bool keyUsageCritical;
+ int keyUsageValue;
+
+ /* Key purpose (aka Extended key usage) */
+ bool keyPurposeEnable;
+ bool keyPurposeCritical;
+ const char *keyPurposeOID1;
+ const char *keyPurposeOID2;
+
+ /* if zero, then the current time will be used */
+ time_t start;
+ time_t expire;
+};
+
+
+/*
+ * Turns an ASN1 object into a DER encoded byte array
+ */
+static void testTLSDerEncode(ASN1_TYPE src,
+ const char *src_name,
+ gnutls_datum_t * res)
+{
+ int size;
+ char *data = NULL;
+
+ size = 0;
+ asn1_der_coding(src, src_name, NULL, &size, NULL);
+
+ if (VIR_ALLOC_N(data, size) < 0)
+ abort();
+
+ asn1_der_coding(src, src_name, data, &size, NULL);
+
+ res->data = (unsigned char *)data;
+ res->size = size;
+}
+
+
+/*
+ * This is a fairly lame x509 certificate generator.
+ *
+ * Do not copy/use this code for generating real certificates
+ * since it leaves out many things that you would want in
+ * certificates for real world usage.
+ *
+ * This is good enough only for doing tests of the libvirt
+ * TLS certificate code
+ */
+static void
+testTLSGenerateCert(struct testTLSCertReq *req)
+{
+ gnutls_x509_crt_t crt;
+ int err;
+ static char buffer[1024*1024];
+ size_t size = sizeof(buffer);
+ char serial[5] = { 1, 2, 3, 4, 0 };
+ gnutls_datum_t der = { (unsigned char *)buffer, size };
+ time_t start = req->start;
+ time_t expire = req->expire;
+
+ if (!start)
+ start = time(NULL);
+ if (!expire)
+ expire = time(NULL) + (60*60*24);
+
+ /*
+ * Prepare our new certificate object
+ */
+ if ((err = gnutls_x509_crt_init(&crt)) < 0) {
+ VIR_WARN("Failed to initialize certificate %s", gnutls_strerror(err));
+ abort();
+ }
+ if ((err = gnutls_x509_crt_set_key(crt, privkey)) < 0) {
+ VIR_WARN("Failed to set certificate key %s", gnutls_strerror(err));
+ abort();
+ }
+
+ /*
+ * A v3 certificate is required in order to be able
+ * set any of the basic constraints, key purpose and
+ * key usage data
+ */
+ gnutls_x509_crt_set_version(crt, 3);
+
+ if (req->country) {
+ if ((err = gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COUNTRY_NAME, 0,
+ req->country,
strlen(req->country))) < 0) {
+ VIR_WARN("Failed to set certificate country name %s",
gnutls_strerror(err));
+ abort();
+ }
+ }
+ if (req->cn) {
+ if ((err = gnutls_x509_crt_set_dn_by_oid(crt, GNUTLS_OID_X520_COMMON_NAME, 0,
+ req->cn, strlen(req->cn))) < 0)
{
+ VIR_WARN("Failed to set certificate common name %s",
gnutls_strerror(err));
+ abort();
+ }
+ }
+
+ /*
+ * Setup the subject altnames, which are used
+ * for hostname checks in live sessions
+ */
+ if (req->altname1) {
+ if ((err = gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME,
+ req->altname1,
+ strlen(req->altname1),
+ GNUTLS_FSAN_APPEND))) {
+ VIR_WARN("Failed to set certificate alt name %s",
gnutls_strerror(err));
+ abort();
+ }
+ }
+ if (req->altname2) {
+ if ((err = gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_DNSNAME,
+ req->altname2,
+ strlen(req->altname2),
+ GNUTLS_FSAN_APPEND))) {
+ VIR_WARN("Failed to set certificate %s alt name",
gnutls_strerror(err));
+ abort();
+ }
+ }
+
+ /*
+ * IP address need to be put into the cert in their
+ * raw byte form, not strings, hence this is a little
+ * more complicated
+ */
+ if (req->ipaddr1) {
+ virSocketAddr addr;
+ char *data;
+ int len;
+ if (virSocketParseAddr(req->ipaddr1, &addr, 0) < 0) {
+ VIR_WARN("Cannot parse %s", req->ipaddr1);
+ abort();
+ }
+
+ if (addr.data.sa.sa_family == AF_INET) {
+ data = (char*)&addr.data.inet4.sin_addr;
+ len = 4;
+ } else {
+ data = (char*)&addr.data.inet6.sin6_addr;
+ len = 16;
+ }
+
+ if ((err = gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_IPADDRESS,
+ data, len, GNUTLS_FSAN_APPEND)))
{
+ VIR_WARN("Failed to set certificate alt name %s",
gnutls_strerror(err));
+ abort();
+ }
+ }
+ if (req->ipaddr2) {
+ virSocketAddr addr;
+ char *data;
+ int len;
+ if (virSocketParseAddr(req->ipaddr2, &addr, 0) < 0) {
+ VIR_WARN("Cannot parse %s", req->ipaddr2);
+ abort();
+ }
+
+ if (addr.data.sa.sa_family == AF_INET) {
+ data = (char*)&addr.data.inet4.sin_addr;
+ len = 4;
+ } else {
+ data = (char*)&addr.data.inet6.sin6_addr;
+ len = 16;
+ }
+
+ if ((err = gnutls_x509_crt_set_subject_alt_name(crt, GNUTLS_SAN_IPADDRESS,
+ data, len, GNUTLS_FSAN_APPEND)))
{
+ VIR_WARN("Failed to set certificate alt name %s",
gnutls_strerror(err));
+ abort();
+ }
+ }
+
+
+ /*
+ * Basic constraints are used to decide if the cert
+ * is for a CA or not. We can't use the convenient
+ * gnutls API for setting this, since it hardcodes
+ * the 'critical' field which we want control over
+ */
+ if (req->basicConstraintsEnable) {
+ ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+
+ asn1_create_element(pkix_asn1, "PKIX1.BasicConstraints", &ext);
+ asn1_write_value(ext, "cA", req->basicConstraintsIsCA ?
"TRUE" : "FALSE", 1);
+ asn1_write_value(ext, "pathLenConstraint", NULL, 0);
+ testTLSDerEncode(ext, "", &der);
+ if ((err = gnutls_x509_crt_set_extension_by_oid(crt,
+ "2.5.29.19",
+ der.data,
+ der.size,
+
req->basicConstraintsCritical)) < 0) {
+ VIR_WARN("Failed to set certificate basic constraints %s",
gnutls_strerror(err));
+ abort();
+ }
+ asn1_delete_structure(&ext);
+ VIR_FREE(der.data);
+ }
+
+ /*
+ * Next up the key usage extension. Again we can't
+ * use the gnutls API since it hardcodes the extension
+ * to be 'critical'
+ */
+ if (req->keyUsageEnable) {
+ ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+ char str[2];
+
+ str[0] = req->keyUsageValue & 0xff;
+ str[1] = (req->keyUsageValue >> 8) & 0xff;
+
+ asn1_create_element(pkix_asn1, "PKIX1.KeyUsage", &ext);
+ asn1_write_value(ext, "", str, 9);
+ testTLSDerEncode(ext, "", &der);
+ if ((err = gnutls_x509_crt_set_extension_by_oid(crt,
+ "2.5.29.15",
+ der.data,
+ der.size,
+ req->keyUsageCritical)) <
0) {
+ VIR_WARN("Failed to set certificate key usage %s",
gnutls_strerror(err));
+ abort();
+ }
+ asn1_delete_structure(&ext);
+ VIR_FREE(der.data);
+ }
+
+ /*
+ * Finally the key purpose extension. This time
+ * gnutls has the opposite problem, always hardcoding
+ * it to be non-critical. So once again we have to
+ * set this the hard way building up ASN1 data ourselves
+ */
+ if (req->keyPurposeEnable) {
+ ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+
+ asn1_create_element(pkix_asn1, "PKIX1.ExtKeyUsageSyntax", &ext);
+ if (req->keyPurposeOID1) {
+ asn1_write_value(ext, "", "NEW", 1);
+ asn1_write_value(ext, "?LAST", req->keyPurposeOID1, 1);
+ }
+ if (req->keyPurposeOID2) {
+ asn1_write_value(ext, "", "NEW", 1);
+ asn1_write_value(ext, "?LAST", req->keyPurposeOID2, 1);
+ }
+ testTLSDerEncode(ext, "", &der);
+ if ((err = gnutls_x509_crt_set_extension_by_oid(crt,
+ "2.5.29.37",
+ der.data,
+ der.size,
+ req->keyPurposeCritical)) <
0) {
+ VIR_WARN("Failed to set certificate key purpose %s",
gnutls_strerror(err));
+ abort();
+ }
+ asn1_delete_structure(&ext);
+ VIR_FREE(der.data);
+ }
+
+ /*
+ * Any old serial number will do, so lets pick 5
+ */
+ if ((err = gnutls_x509_crt_set_serial(crt, serial, 5)) < 0) {
+ VIR_WARN("Failed to set certificate serial %s", gnutls_strerror(err));
+ abort();
+ }
+
+ if ((err = gnutls_x509_crt_set_activation_time(crt, start)) < 0) {
+ VIR_WARN("Failed to set certificate activation %s",
gnutls_strerror(err));
+ abort();
+ }
+ if ((err = gnutls_x509_crt_set_expiration_time(crt, expire)) < 0) {
+ VIR_WARN("Failed to set certificate expiration %s",
gnutls_strerror(err));
+ abort();
+ }
+
+
+ /*
+ * If no 'cart' is set then we are self signing
+ * the cert. This is done for CA certs
+ */
+ if ((err = gnutls_x509_crt_sign(crt, req->cacrt ? req->cacrt : crt, privkey)
< 0)) {
+ VIR_WARN("Failed to sign certificate %s", gnutls_strerror(err));
+ abort();
+ }
+
+ /*
+ * Finally write the new cert out to disk
+ */
+ if ((err = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, buffer, &size) <
0)) {
+ VIR_WARN("Failed to export certificate %s", gnutls_strerror(err));
+ abort();
+ }
+
+ if (virFileWriteStr(req->filename, buffer, 0600) < 0) {
+ VIR_WARN("Failed to write certificate %s %s", req->filename,
gnutls_strerror(err));
+ abort();
+ }
+
+ req->crt = crt;
+ return;
+}
+
+
+/*
+ * This loads the private key we defined earlier
+ */
+static gnutls_x509_privkey_t testTLSLoadKey(void)
+{
+ gnutls_x509_privkey_t key;
+ const gnutls_datum_t data = { (unsigned char *)PRIVATE_KEY, strlen(PRIVATE_KEY) };
+
+ gnutls_x509_privkey_init(&key);
+
+ gnutls_x509_privkey_import(key, &data, GNUTLS_X509_FMT_PEM);
+
+ return key;
+}
+
+
+struct testTLSContextData {
+ bool isServer;
+ struct testTLSCertReq careq;
+ struct testTLSCertReq certreq;
+ bool expectFail;
+};
+
+
+/*
+ * This tests sanity checking of our own certificates
+ *
+ * This code is done when libvirtd starts up, or before
+ * a libvirt client connects. The test is ensuring that
+ * the creation of virNetTLSContextPtr fails if we
+ * give bogus certs, or suceeds for good certs
+ */
+static int testTLSContextInit(const void *opaque)
+{
+ struct testTLSContextData *data = (struct testTLSContextData *)opaque;
+ virNetTLSContextPtr ctxt = NULL;
+ int ret = -1;
+
+ testTLSGenerateCert(&data->careq);
+ data->certreq.cacrt = data->careq.crt;
+ testTLSGenerateCert(&data->certreq);
+
+ if (data->isServer) {
+ ctxt = virNetTLSContextNewServer(data->careq.filename,
+ NULL,
+ data->certreq.filename,
+ keyfile,
+ NULL,
+ true,
+ true);
+ } else {
+ ctxt = virNetTLSContextNewClient(data->careq.filename,
+ NULL,
+ data->certreq.filename,
+ keyfile,
+ true,
+ true);
+ }
+
+ if (ctxt) {
+ if (data->expectFail) {
+ VIR_ERROR("Expected failure %s against %s",
+ data->careq.filename, data->certreq.filename);
+ goto cleanup;
+ }
+ } else {
+ virErrorPtr err = virGetLastError();
+ if (!data->expectFail) {
+ VIR_ERROR("Unexpected failure %s against %s",
+ data->careq.filename, data->certreq.filename);
+ goto cleanup;
+ }
+ VIR_DEBUG("Got error %s", err ? err->message :
"<unknown>");
+ }
+
+ ret = 0;
+
+cleanup:
+ virNetTLSContextFree(ctxt);
+ gnutls_x509_crt_deinit(data->careq.crt);
+ gnutls_x509_crt_deinit(data->certreq.crt);
+ data->careq.crt = data->certreq.crt = NULL;
+ /* When troubleshooting this tests, we often want to leave the certs on disk */
+ if (getenv("VIRT_TEST_DEBUG_CERTS") == NULL) {
+ unlink(data->careq.filename);
+ unlink(data->certreq.filename);
+ }
+ return ret;
+}
+
+
+
+struct testTLSSessionData {
+ struct testTLSCertReq careq;
+ struct testTLSCertReq othercareq;
+ struct testTLSCertReq serverreq;
+ struct testTLSCertReq clientreq;
+ bool expectServerFail;
+ bool expectClientFail;
+ const char *hostname;
+ const char *const* wildcards;
+};
+
+
+static ssize_t testWrite(const char *buf, size_t len, void *opaque)
+{
+ int *fd = opaque;
+
+ return write(*fd, buf, len);
+}
+
+static ssize_t testRead(char *buf, size_t len, void *opaque)
+{
+ int *fd = opaque;
+
+ return read(*fd, buf, len);
+}
+
+/*
+ * This tests validation checking of peer certificates
+ *
+ * This is replicating the checks that are done for an
+ * active TLS session after handshake completes. To
+ * simulate that we create our TLS contexts, skipping
+ * sanity checks. When then get a socketpair, and
+ * initiate a TLS session across them. Finally do
+ * do actual cert validation tests
+ */
+static int testTLSSessionInit(const void *opaque)
+{
+ struct testTLSSessionData *data = (struct testTLSSessionData *)opaque;
+ virNetTLSContextPtr clientCtxt = NULL;
+ virNetTLSContextPtr serverCtxt = NULL;
+ virNetTLSSessionPtr clientSess = NULL;
+ virNetTLSSessionPtr serverSess = NULL;
+ int ret = -1;
+ int channel[2];
+ bool clientShake = false;
+ bool serverShake = false;
+
+
+ /* We'll use this for our fake client-server connection */
+ if (socketpair(AF_UNIX, SOCK_STREAM, 0, channel) < 0)
+ abort();
+
+ /*
+ * We have an evil loop to do the handshake in a single
+ * thread, so we need these non-blocking to avoid deadlock
+ * of ourselves
+ */
+ ignore_value(virSetNonBlock(channel[0]));
+ ignore_value(virSetNonBlock(channel[1]));
+
+
+ /* Generate all the certs we need for this test */
+ testTLSGenerateCert(&data->careq);
+ data->serverreq.cacrt = data->careq.crt;
+ testTLSGenerateCert(&data->serverreq);
+
+ if (data->othercareq.filename) {
+ testTLSGenerateCert(&data->othercareq);
+ data->clientreq.cacrt = data->othercareq.crt;
+ } else {
+ data->clientreq.cacrt = data->careq.crt;
+ }
+ testTLSGenerateCert(&data->clientreq);
+
+
+ /* We skip initial sanity checks here because we
+ * want to make sure that problems are being
+ * detected at the TLS session validation stage
+ */
+ serverCtxt = virNetTLSContextNewServer(data->careq.filename,
+ NULL,
+ data->serverreq.filename,
+ keyfile,
+ data->wildcards,
+ false,
+ true);
+
+ clientCtxt = virNetTLSContextNewClient(data->othercareq.filename ?
+ data->othercareq.filename :
+ data->careq.filename,
+ NULL,
+ data->clientreq.filename,
+ keyfile,
+ false,
+ true);
+
+ if (!serverCtxt) {
+ VIR_ERROR("Unexpected failure loading %s against %s",
+ data->careq.filename, data->serverreq.filename);
+ goto cleanup;
+ }
+ if (!clientCtxt) {
+ VIR_ERROR("Unexpected failure loading %s against %s",
+ data->othercareq.filename ? data->othercareq.filename :
+ data->careq.filename, data->clientreq.filename);
+ goto cleanup;
+ }
+
+
+ /* Now the real part of the test, setup the sessions */
+ serverSess = virNetTLSSessionNew(serverCtxt, NULL);
+ clientSess = virNetTLSSessionNew(clientCtxt, data->hostname);
+
+ if (!serverSess) {
+ VIR_ERROR("Unexpected failure using %s against %s",
+ data->careq.filename, data->serverreq.filename);
+ goto cleanup;
+ }
+ if (!clientSess) {
+ VIR_ERROR("Unexpected failure using %s against %s",
+ data->othercareq.filename ? data->othercareq.filename :
+ data->careq.filename, data->clientreq.filename);
+ goto cleanup;
+ }
+
+ /* For handshake to work, we need to set the I/O callbacks
+ * to read/write over the socketpair
+ */
+ virNetTLSSessionSetIOCallbacks(serverSess, testWrite, testRead, &channel[0]);
+ virNetTLSSessionSetIOCallbacks(clientSess, testWrite, testRead, &channel[1]);
+
+ /*
+ * Finally we loop around & around doing handshake on each
+ * session until we get an error, or the handshake completes.
+ * This relies on the socketpair being nonblocking to avoid
+ * deadlocking ourselves upon handshake
+ */
+ do {
+ int rv;
+ if (!serverShake) {
+ rv = virNetTLSSessionHandshake(serverSess);
+ if (rv < 0)
+ goto cleanup;
+ if (rv == VIR_NET_TLS_HANDSHAKE_COMPLETE)
+ serverShake = true;
+ }
+ if (!clientShake) {
+ rv = virNetTLSSessionHandshake(clientSess);
+ if (rv < 0)
+ goto cleanup;
+ if (rv == VIR_NET_TLS_HANDSHAKE_COMPLETE)
+ serverShake = true;
+ }
+ } while (!clientShake && !serverShake);
+
+
+ /* Finally make sure the server validation does what
+ * we were expecting
+ */
+ if (virNetTLSContextCheckCertificate(serverCtxt,
+ serverSess) < 0) {
+ if (!data->expectServerFail) {
+ VIR_ERROR("Unexpected server cert check fail");
+ goto cleanup;
+ } else {
+ VIR_DEBUG("Got expected server cert fail");
+ }
+ } else {
+ if (data->expectServerFail) {
+ VIR_ERROR("Expected server cert check fail");
+ goto cleanup;
+ } else {
+ VIR_DEBUG("Not unexpected server cert fail");
+ }
+ }
+
+ /*
+ * And the same for the client validation check
+ */
+ if (virNetTLSContextCheckCertificate(clientCtxt,
+ clientSess) < 0) {
+ if (!data->expectClientFail) {
+ VIR_ERROR("Unexpected client cert check fail");
+ goto cleanup;
+ } else {
+ VIR_DEBUG("Got expected client cert fail");
+ }
+ } else {
+ if (data->expectClientFail) {
+ VIR_ERROR("Expected client cert check fail");
+ goto cleanup;
+ } else {
+ VIR_DEBUG("Not unexpected client cert fail");
+ }
+ }
+
+ ret = 0;
+
+cleanup:
+ virNetTLSContextFree(serverCtxt);
+ virNetTLSContextFree(clientCtxt);
+ gnutls_x509_crt_deinit(data->careq.crt);
+ if (data->othercareq.filename)
+ gnutls_x509_crt_deinit(data->othercareq.crt);
+ gnutls_x509_crt_deinit(data->clientreq.crt);
+ gnutls_x509_crt_deinit(data->serverreq.crt);
+ data->careq.crt = data->othercareq.crt = data->clientreq.crt =
data->serverreq.crt = NULL;
+
+ /* When troubleshooting this tests, we often want to leave the certs on disk */
+ if (getenv("VIRT_TEST_DEBUG_CERTS") == NULL) {
+ unlink(data->careq.filename);
+ if (data->othercareq.filename)
+ unlink(data->othercareq.filename);
+ unlink(data->clientreq.filename);
+ unlink(data->serverreq.filename);
+ }
+ VIR_FORCE_CLOSE(channel[0]);
+ VIR_FORCE_CLOSE(channel[1]);
+ return ret;
+}
+
+
+static int
+mymain(void)
+{
+ int ret = 0;
+ if (asn1_array2tree(pkix_asn1_tab, &pkix_asn1, NULL) != ASN1_SUCCESS)
+ abort();
+
+ gnutls_global_init();
+
+ privkey = testTLSLoadKey();
+
+ if (virFileWriteStr(keyfile, PRIVATE_KEY, 0600) < 0)
+ return EXIT_FAILURE;
+
+#define DO_CTX_TEST(isServer, caReq, certReq, expectFail) \
+ do { \
+ struct testTLSContextData data = { \
+ isServer, caReq, certReq, expectFail, \
+ }; \
+ if (virtTestRun("TLS Context", 1, testTLSContextInit, &data) <
0) \
+ ret = -1; \
+ } while (0)
+
+#define DO_SESS_TEST(caReq, serverReq, clientReq, expectServerFail, expectClientFail,
hostname, wildcards) \
+ do { \
+ struct testTLSSessionData data = { \
+ caReq, { 0 }, serverReq, clientReq, \
+ expectServerFail, expectClientFail, hostname, wildcards \
+ }; \
+ if (virtTestRun("TLS Session", 1, testTLSSessionInit, &data) <
0) \
+ ret = -1; \
+ } while (0)
+
+#define DO_SESS_TEST_EXT(caReq, othercaReq, serverReq, clientReq, expectServerFail,
expectClientFail, hostname, wildcards) \
+ do { \
+ struct testTLSSessionData data = { \
+ caReq, othercaReq, serverReq, clientReq, \
+ expectServerFail, expectClientFail, hostname, wildcards \
+ }; \
+ if (virtTestRun("TLS Session", 1, testTLSSessionInit, &data) <
0) \
+ ret = -1; \
+ } while (0)
+
+ /* A perfect CA, perfect client & perfect server */
+
+ /* Basic:CA:critical */
+ struct testTLSCertReq cacertreq = {
+ NULL, NULL, "cacert.pem", "UK",
+ "libvirt CA", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ struct testTLSCertReq servercertreq = {
+ NULL, NULL, "servercert.pem", "UK",
+ "libvirt.org", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+ struct testTLSCertReq clientcertreq = {
+ NULL, NULL, "clientcert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ 0, 0,
+ };
+
+
+ DO_CTX_TEST(true, cacertreq, servercertreq, false);
+ DO_CTX_TEST(false, cacertreq, clientcertreq, false);
+
+
+ /* Some other CAs which are good */
+
+ /* Basic:CA:critical */
+ struct testTLSCertReq cacert1req = {
+ NULL, NULL, "cacert1.pem", "UK",
+ "libvirt CA 1", NULL, NULL, NULL, NULL,
+ true, true, true,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* Basic:CA:not-critical */
+ struct testTLSCertReq cacert2req = {
+ NULL, NULL, "cacert2.pem", "UK",
+ "libvirt CA 2", NULL, NULL, NULL, NULL,
+ true, false, true,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* Basic:not-CA:not-critical */
+#if 0
+ /* Default GNUTLS session config forbids use of CAs without
+ * basic constraints, so skip this otherwise valid test
+ */
+ struct testTLSCertReq cacert3req = {
+ NULL, NULL, "cacert3.pem", "UK",
+ "libvirt CA 3", NULL, NULL, NULL, NULL,
+ true, false, false,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+#endif
+ /* Key usage:cert-sign:critical */
+ struct testTLSCertReq cacert4req = {
+ NULL, NULL, "cacert4.pem", "UK",
+ "libvirt CA 4", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* Key usage:dig-sig:not-critical */
+ struct testTLSCertReq cacert5req = {
+ NULL, NULL, "cacert5.pem", "UK",
+ "libvirt CA 5", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(true, cacert1req, servercertreq, false);
+ DO_CTX_TEST(true, cacert2req, servercertreq, false);
+#if 0
+ DO_CTX_TEST(true, cacert3req, servercertreq, false);
+#endif
+ DO_CTX_TEST(true, cacert4req, servercertreq, false);
+ DO_CTX_TEST(true, cacert5req, servercertreq, false);
+
+ /* Now some bad certs */
+
+ /* no-basic */
+ struct testTLSCertReq cacert6req = {
+ NULL, NULL, "cacert6.pem", "UK",
+ "libvirt CA 6", NULL, NULL, NULL, NULL,
+ false, false, false,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* Key usage:dig-sig:critical */
+ struct testTLSCertReq cacert7req = {
+ NULL, NULL, "cacert7.pem", "UK",
+ "libvirt CA 7", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(true, cacert6req, servercertreq, true);
+ DO_CTX_TEST(true, cacert7req, servercertreq, true);
+
+
+ /* Various good servers */
+ /* no usage or purpose */
+ struct testTLSCertReq servercert1req = {
+ NULL, NULL, "servercert1.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* usage:cert-sign+dig-sig+encipher:critical */
+ struct testTLSCertReq servercert2req = {
+ NULL, NULL, "servercert2.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* usage:cert-sign:not-critical */
+ struct testTLSCertReq servercert3req = {
+ NULL, NULL, "servercert3.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, false, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* purpose:server:critical */
+ struct testTLSCertReq servercert4req = {
+ NULL, NULL, "servercert4.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+ /* purpose:server:not-critical */
+ struct testTLSCertReq servercert5req = {
+ NULL, NULL, "servercert5.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+ /* purpose:client+server:critical */
+ struct testTLSCertReq servercert6req = {
+ NULL, NULL, "servercert6.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
+ 0, 0,
+ };
+ /* purpose:client+server:not-critical */
+ struct testTLSCertReq servercert7req = {
+ NULL, NULL, "servercert7.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(true, cacertreq, servercert1req, false);
+ DO_CTX_TEST(true, cacertreq, servercert2req, false);
+ DO_CTX_TEST(true, cacertreq, servercert3req, false);
+ DO_CTX_TEST(true, cacertreq, servercert4req, false);
+ DO_CTX_TEST(true, cacertreq, servercert5req, false);
+ DO_CTX_TEST(true, cacertreq, servercert6req, false);
+ DO_CTX_TEST(true, cacertreq, servercert7req, false);
+ /* Bad servers */
+
+ /* usage:cert-sign:critical */
+ struct testTLSCertReq servercert8req = {
+ NULL, NULL, "servercert8.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* purpose:client:critical */
+ struct testTLSCertReq servercert9req = {
+ NULL, NULL, "servercert9.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ 0, 0,
+ };
+ /* usage: none:critical */
+ struct testTLSCertReq servercert10req = {
+ NULL, NULL, "servercert10.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(true, cacertreq, servercert8req, true);
+ DO_CTX_TEST(true, cacertreq, servercert9req, true);
+ DO_CTX_TEST(true, cacertreq, servercert10req, true);
+
+
+
+ /* Various good clients */
+ /* no usage or purpose */
+ struct testTLSCertReq clientcert1req = {
+ NULL, NULL, "clientcert1.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* usage:cert-sign+dig-sig+encipher:critical */
+ struct testTLSCertReq clientcert2req = {
+ NULL, NULL, "clientcert2.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* usage:cert-sign:not-critical */
+ struct testTLSCertReq clientcert3req = {
+ NULL, NULL, "clientcert3.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, false, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* purpose:client:critical */
+ struct testTLSCertReq clientcert4req = {
+ NULL, NULL, "clientcert4.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ 0, 0,
+ };
+ /* purpose:client:not-critical */
+ struct testTLSCertReq clientcert5req = {
+ NULL, NULL, "clientcert5.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ 0, 0,
+ };
+ /* purpose:client+client:critical */
+ struct testTLSCertReq clientcert6req = {
+ NULL, NULL, "clientcert6.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
+ 0, 0,
+ };
+ /* purpose:client+client:not-critical */
+ struct testTLSCertReq clientcert7req = {
+ NULL, NULL, "clientcert7.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(false, cacertreq, clientcert1req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert2req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert3req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert4req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert5req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert6req, false);
+ DO_CTX_TEST(false, cacertreq, clientcert7req, false);
+ /* Bad clients */
+
+ /* usage:cert-sign:critical */
+ struct testTLSCertReq clientcert8req = {
+ NULL, NULL, "clientcert8.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+ /* purpose:client:critical */
+ struct testTLSCertReq clientcert9req = {
+ NULL, NULL, "clientcert9.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ false, false, 0,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+ /* usage: none:critical */
+ struct testTLSCertReq clientcert10req = {
+ NULL, NULL, "clientcert10.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, 0,
+ false, false, NULL, NULL,
+ 0, 0,
+ };
+
+ DO_CTX_TEST(false, cacertreq, clientcert8req, true);
+ DO_CTX_TEST(false, cacertreq, clientcert9req, true);
+ DO_CTX_TEST(false, cacertreq, clientcert10req, true);
+
+
+
+ /* Expired stuff */
+
+ struct testTLSCertReq cacertexpreq = {
+ NULL, NULL, "cacert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ 0, 1,
+ };
+ struct testTLSCertReq servercertexpreq = {
+ NULL, NULL, "servercert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 1,
+ };
+ struct testTLSCertReq clientcertexpreq = {
+ NULL, NULL, "clientcert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ 0, 1,
+ };
+
+ DO_CTX_TEST(true, cacertexpreq, servercertreq, true);
+ DO_CTX_TEST(true, cacertreq, servercertexpreq, true);
+ DO_CTX_TEST(false, cacertreq, clientcertexpreq, true);
+
+
+ /* Not activated stuff */
+
+ struct testTLSCertReq cacertnewreq = {
+ NULL, NULL, "cacert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, true,
+ true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+ false, false, NULL, NULL,
+ time(NULL)+(60*60), time(NULL)+(60*60*2),
+ };
+ struct testTLSCertReq servercertnewreq = {
+ NULL, NULL, "servercert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ time(NULL)+(60*60), time(NULL)+(60*60*2),
+ };
+ struct testTLSCertReq clientcertnewreq = {
+ NULL, NULL, "clientcert.pem", "UK",
+ "libvirt", NULL, NULL, NULL, NULL,
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
+ time(NULL)+(60*60), time(NULL)+(60*60*2),
+ };
+
+ DO_CTX_TEST(true, cacertnewreq, servercertreq, true);
+ DO_CTX_TEST(true, cacertreq, servercertnewreq, true);
+ DO_CTX_TEST(false, cacertreq, clientcertnewreq, true);
+
+
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, false, false,
"libvirt.org", NULL);
+ DO_SESS_TEST_EXT(cacertreq, cacert1req, servercertreq, clientcertreq, true, true,
"libvirt.org", NULL);
+
+ /* When an altname is set, the CN is ignored, so it must be duplicated
+ * as an altname for it to match */
+ struct testTLSCertReq servercertalt1req = {
+ NULL, NULL, "servercert.pem", "UK",
+ "libvirt.org", "www.libvirt.org", "libvirt.org",
"192.168.122.1", "fec0::dead:beaf",
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+ /* This intentionally doesn't replicate */
+ struct testTLSCertReq servercertalt2req = {
+ NULL, NULL, "servercert.pem", "UK",
+ "libvirt.org", "www.libvirt.org",
"wiki.libvirt.org", "192.168.122.1", "fec0::dead:beaf",
+ true, true, false,
+ true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+ true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
+ 0, 0,
+ };
+
+ DO_SESS_TEST(cacertreq, servercertalt1req, clientcertreq, false, false,
"libvirt.org", NULL);
+ DO_SESS_TEST(cacertreq, servercertalt1req, clientcertreq, false, false,
"www.libvirt.org", NULL);
+ DO_SESS_TEST(cacertreq, servercertalt1req, clientcertreq, false, true,
"wiki.libvirt.org", NULL);
+
+ DO_SESS_TEST(cacertreq, servercertalt2req, clientcertreq, false, true,
"libvirt.org", NULL);
+ DO_SESS_TEST(cacertreq, servercertalt2req, clientcertreq, false, false,
"www.libvirt.org", NULL);
+ DO_SESS_TEST(cacertreq, servercertalt2req, clientcertreq, false, false,
"wiki.libvirt.org", NULL);
+
+ const char *const wildcards1[] = {
+ "C=UK,CN=dogfood",
+ NULL,
+ };
+ const char *const wildcards2[] = {
+ "C=UK,CN=libvirt",
+ NULL,
+ };
+ const char *const wildcards3[] = {
+ "C=UK,CN=dogfood",
+ "C=UK,CN=libvirt",
+ NULL,
+ };
+ const char *const wildcards4[] = {
+ "C=UK,CN=libvirtstuff",
+ NULL,
+ };
+ const char *const wildcards5[] = {
+ "C=UK,CN=libvirt*",
+ NULL,
+ };
+ const char *const wildcards6[] = {
+ "C=UK,CN=*virt*",
+ NULL,
+ };
+
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, true, false,
"libvirt.org", wildcards1);
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, false, false,
"libvirt.org", wildcards2);
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, false, false,
"libvirt.org", wildcards3);
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, true, false,
"libvirt.org", wildcards4);
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, false, false,
"libvirt.org", wildcards5);
+ DO_SESS_TEST(cacertreq, servercertreq, clientcertreq, false, false,
"libvirt.org", wildcards6);
+
+ unlink(keyfile);
+
+ asn1_delete_structure(&pkix_asn1);
+
+ return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
+}
+
+#else
+static int
+mymain(int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED)
+{
+ exit (EXIT_AM_SKIP);
+}
+#endif
+
+VIRT_TEST_MAIN(mymain)
--
1.7.6
8:31 a.m.
New subject: [libvirt] [PATCH 2/2] Add a test case for certificate validation
On 07/22/2011 05:06 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange"<berrange(a)redhat.com>
This test case checks certification validation rules for
- Basic constraints
- Key purpose
- Key usage
- Start/expiry times
It checks initial context creation sanity checks, and live
session validation
---
tests/.gitignore | 1 +
tests/Makefile.am | 8 +-
tests/pkix_asn1_tab.c | 567 +++++++++++++++++++
tests/virnettlscontexttest.c | 1246 ++++++++++++++++++++++++++++++++++++++++++
4 files changed, 1821 insertions(+), 1 deletions(-)
create mode 100644 tests/pkix_asn1_tab.c
create mode 100644 tests/virnettlscontexttest.c
ACK.
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
12:43 p.m.
New subject: [libvirt] [PATCH 2/2] Add a test case for certificate validation
On 07/22/2011 05:06 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange"<berrange(a)redhat.com>
This test case checks certification validation rules for
- Basic constraints
- Key purpose
- Key usage
- Start/expiry times
It checks initial context creation sanity checks, and live
session validation
---
I spoke too soon. This breaks the build in multiple ways:
+++ b/tests/pkix_asn1_tab.c
@@ -0,0 +1,567 @@
+/*
+ * This file comes from gnutls, licensed under the GPLv3+
+ */
+
+#include<config.h>
+#include<libtasn1.h>
+
While you already convinced me that -ltasn1 will work (because we
require gnutls, and the gnutls libraries require -ltasn1), you forget
the source side of things. If you don't have libtasn1-devel installed
on Fedora, then compilation fails with:
virnettlscontexttest.c:37:23: fatal error: libtasn1.h: No such file or
directory
Next, if you have new enough gcc and the right devel files, compilation
fails with:
virnettlscontexttest.c:1235: error: the frame size of 5376 bytes is
larger than 4096 bytes [-Wframe-larger-than=]
and on IRC, laine reported:
<laine> Bah. Just making the structs defined inside mymain of
virnettlscontexttext.c as static (or moving them to be global instead of
on the stack) doesn't work - it gets the stack usage down, but then the
first test hits an abort in testTLSGenerateCert (virnettlscontexttest.c:180
<laine> But that has nothing to do with the struct that's being passed
down. Looks like the entire test is broken. Is this failing for others?
Or do I have an older version of a library or something that's causing
gnutls_x509_crt_init to fail?
Any ideas on what needs to be done to fix that?
It doesn't help that libvirt.org is temporarily down at the moment.
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
1:33 p.m.
New subject: [libvirt] [PATCH] tests: fix compilation failures
Even though gnutls is a hard-req for libvirt, and gnutls depends
on libtasn1, that does not mean that you have to have the libtasn1
development files installed. Skip the test rather than failing
compilation in that case.
With newer gcc, the test consumed too much stack space. Move
things to static storage to fix that.
* configure.ac (AC_CHECK_HEADERS): Check for libtasn1.h.
(HAVE_LIBTASN1): New automake conditional.
* tests/Makefile.am (virnettlsconvirnettlscontexttest_SOURCES)
(virnettlscontexttest_LDADD): Allow compilation without libtasn1.
* tests/virnettlscontexttest.c: Skip test if headers not present.
(struct testTLSCertReq): Alter time members.
(testTLSGenerateCert): Reflect the change.
(mymain): Reduce stack usage.
---
With this patch, I successfully skip the test if libtasn1-devel is
not installed, and successfully pass the test on a RHEL 6 machine.
I haven't yet tested on a F14 machine, where I heard reports from
Laine of a failure (possibly due to an older library), but we can
deal with that in a later patch.
I will push this under the build-breaker, once libvirt.org is back
up (or even sooner to an alternate repo, if the downtime gets to
be too painful).
configure.ac | 7 ++-
tests/Makefile.am | 10 +++-
tests/virnettlscontexttest.c | 109 ++++++++++++++++++++---------------------
3 files changed, 67 insertions(+), 59 deletions(-)
diff --git a/configure.ac b/configure.ac
index 9e39f44..4e04950 100644
--- a/configure.ac
+++ b/configure.ac
@@ -136,7 +136,12 @@ LIBS=$old_libs
dnl Availability of various common headers (non-fatal if missing).
AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/un.h \
sys/poll.h syslog.h mntent.h net/ethernet.h linux/magic.h \
- sys/un.h sys/syscall.h netinet/tcp.h ifaddrs.h])
+ sys/un.h sys/syscall.h netinet/tcp.h ifaddrs.h libtasn1.h])
+
+dnl Our only use of libtasn1.h is in the testsuite, and can be skipped
+dnl if the header is not present. Assume -ltasn1 is present if the
+dnl header could be found.
+AM_CONDITIONAL([HAVE_LIBTASN1], [test "x$ac_cv_header_libtasn1_h" =
"xyes"])
AC_CHECK_LIB([intl],[gettext],[])
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 1c91a1e..872aa22 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -454,9 +454,15 @@ virnetsockettest_CFLAGS =
-Dabs_builddir="\"$(abs_builddir)\"" $(AM_CFLAGS)
virnetsockettest_LDADD = ../src/libvirt-net-rpc.la $(LDADDS)
virnettlscontexttest_SOURCES = \
- virnettlscontexttest.c testutils.h testutils.c pkix_asn1_tab.c
+ virnettlscontexttest.c testutils.h testutils.c
virnettlscontexttest_CFLAGS = -Dabs_builddir="\"$(abs_builddir)\""
$(AM_CFLAGS)
-virnettlscontexttest_LDADD = ../src/libvirt-net-rpc.la $(LDADDS) -ltasn1
+virnettlscontexttest_LDADD = ../src/libvirt-net-rpc.la $(LDADDS)
+if HAVE_LIBTASN1
+virnettlscontexttest_SOURCES += pkix_asn1_tab.c
+virnettlscontexttest_LDADD += -ltasn1
+else
+EXTRA_DIST += pkix_asn1_tab.c
+endif
seclabeltest_SOURCES = \
diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
index c8775eb..e70cd8b 100644
--- a/tests/virnettlscontexttest.c
+++ b/tests/virnettlscontexttest.c
@@ -33,7 +33,7 @@
#include "command.h"
#include "network.h"
-#ifndef WIN32
+#if !defined WIN32 && HAVE_LIBTASN1_H
# include <libtasn1.h>
# include <gnutls/gnutls.h>
# include <gnutls/x509.h>
@@ -112,9 +112,10 @@ struct testTLSCertReq {
const char *keyPurposeOID1;
const char *keyPurposeOID2;
- /* if zero, then the current time will be used */
- time_t start;
- time_t expire;
+ /* zero for current time, or non-zero for hours from now */
+ int start_offset;
+ /* zero for 24 hours from now, or non-zero for hours from now */
+ int expire_offset;
};
@@ -160,13 +161,9 @@ testTLSGenerateCert(struct testTLSCertReq *req)
size_t size = sizeof(buffer);
char serial[5] = { 1, 2, 3, 4, 0 };
gnutls_datum_t der = { (unsigned char *)buffer, size };
- time_t start = req->start;
- time_t expire = req->expire;
-
- if (!start)
- start = time(NULL);
- if (!expire)
- expire = time(NULL) + (60*60*24);
+ time_t start = time(NULL) + (60*60*req->start_offset);
+ time_t expire = time(NULL) + (60*60*(req->expire_offset
+ ? req->expire_offset : 24));
/*
* Prepare our new certificate object
@@ -767,7 +764,7 @@ mymain(void)
/* A perfect CA, perfect client & perfect server */
/* Basic:CA:critical */
- struct testTLSCertReq cacertreq = {
+ static struct testTLSCertReq cacertreq = {
NULL, NULL, "cacert.pem", "UK",
"libvirt CA", NULL, NULL, NULL, NULL,
true, true, true,
@@ -775,7 +772,7 @@ mymain(void)
false, false, NULL, NULL,
0, 0,
};
- struct testTLSCertReq servercertreq = {
+ static struct testTLSCertReq servercertreq = {
NULL, NULL, "servercert.pem", "UK",
"libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
@@ -783,7 +780,7 @@ mymain(void)
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0,
};
- struct testTLSCertReq clientcertreq = {
+ static struct testTLSCertReq clientcertreq = {
NULL, NULL, "clientcert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -800,7 +797,7 @@ mymain(void)
/* Some other CAs which are good */
/* Basic:CA:critical */
- struct testTLSCertReq cacert1req = {
+ static struct testTLSCertReq cacert1req = {
NULL, NULL, "cacert1.pem", "UK",
"libvirt CA 1", NULL, NULL, NULL, NULL,
true, true, true,
@@ -809,7 +806,7 @@ mymain(void)
0, 0,
};
/* Basic:CA:not-critical */
- struct testTLSCertReq cacert2req = {
+ static struct testTLSCertReq cacert2req = {
NULL, NULL, "cacert2.pem", "UK",
"libvirt CA 2", NULL, NULL, NULL, NULL,
true, false, true,
@@ -822,7 +819,7 @@ mymain(void)
/* Default GNUTLS session config forbids use of CAs without
* basic constraints, so skip this otherwise valid test
*/
- struct testTLSCertReq cacert3req = {
+ static struct testTLSCertReq cacert3req = {
NULL, NULL, "cacert3.pem", "UK",
"libvirt CA 3", NULL, NULL, NULL, NULL,
true, false, false,
@@ -832,7 +829,7 @@ mymain(void)
};
# endif
/* Key usage:cert-sign:critical */
- struct testTLSCertReq cacert4req = {
+ static struct testTLSCertReq cacert4req = {
NULL, NULL, "cacert4.pem", "UK",
"libvirt CA 4", NULL, NULL, NULL, NULL,
true, true, true,
@@ -841,7 +838,7 @@ mymain(void)
0, 0,
};
/* Key usage:dig-sig:not-critical */
- struct testTLSCertReq cacert5req = {
+ static struct testTLSCertReq cacert5req = {
NULL, NULL, "cacert5.pem", "UK",
"libvirt CA 5", NULL, NULL, NULL, NULL,
true, true, true,
@@ -861,7 +858,7 @@ mymain(void)
/* Now some bad certs */
/* no-basic */
- struct testTLSCertReq cacert6req = {
+ static struct testTLSCertReq cacert6req = {
NULL, NULL, "cacert6.pem", "UK",
"libvirt CA 6", NULL, NULL, NULL, NULL,
false, false, false,
@@ -870,7 +867,7 @@ mymain(void)
0, 0,
};
/* Key usage:dig-sig:critical */
- struct testTLSCertReq cacert7req = {
+ static struct testTLSCertReq cacert7req = {
NULL, NULL, "cacert7.pem", "UK",
"libvirt CA 7", NULL, NULL, NULL, NULL,
true, true, true,
@@ -885,7 +882,7 @@ mymain(void)
/* Various good servers */
/* no usage or purpose */
- struct testTLSCertReq servercert1req = {
+ static struct testTLSCertReq servercert1req = {
NULL, NULL, "servercert1.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -894,7 +891,7 @@ mymain(void)
0, 0,
};
/* usage:cert-sign+dig-sig+encipher:critical */
- struct testTLSCertReq servercert2req = {
+ static struct testTLSCertReq servercert2req = {
NULL, NULL, "servercert2.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -903,7 +900,7 @@ mymain(void)
0, 0,
};
/* usage:cert-sign:not-critical */
- struct testTLSCertReq servercert3req = {
+ static struct testTLSCertReq servercert3req = {
NULL, NULL, "servercert3.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -912,7 +909,7 @@ mymain(void)
0, 0,
};
/* purpose:server:critical */
- struct testTLSCertReq servercert4req = {
+ static struct testTLSCertReq servercert4req = {
NULL, NULL, "servercert4.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -921,7 +918,7 @@ mymain(void)
0, 0,
};
/* purpose:server:not-critical */
- struct testTLSCertReq servercert5req = {
+ static struct testTLSCertReq servercert5req = {
NULL, NULL, "servercert5.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -930,7 +927,7 @@ mymain(void)
0, 0,
};
/* purpose:client+server:critical */
- struct testTLSCertReq servercert6req = {
+ static struct testTLSCertReq servercert6req = {
NULL, NULL, "servercert6.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -939,7 +936,7 @@ mymain(void)
0, 0,
};
/* purpose:client+server:not-critical */
- struct testTLSCertReq servercert7req = {
+ static struct testTLSCertReq servercert7req = {
NULL, NULL, "servercert7.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -958,7 +955,7 @@ mymain(void)
/* Bad servers */
/* usage:cert-sign:critical */
- struct testTLSCertReq servercert8req = {
+ static struct testTLSCertReq servercert8req = {
NULL, NULL, "servercert8.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -967,7 +964,7 @@ mymain(void)
0, 0,
};
/* purpose:client:critical */
- struct testTLSCertReq servercert9req = {
+ static struct testTLSCertReq servercert9req = {
NULL, NULL, "servercert9.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -976,7 +973,7 @@ mymain(void)
0, 0,
};
/* usage: none:critical */
- struct testTLSCertReq servercert10req = {
+ static struct testTLSCertReq servercert10req = {
NULL, NULL, "servercert10.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -993,7 +990,7 @@ mymain(void)
/* Various good clients */
/* no usage or purpose */
- struct testTLSCertReq clientcert1req = {
+ static struct testTLSCertReq clientcert1req = {
NULL, NULL, "clientcert1.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1002,7 +999,7 @@ mymain(void)
0, 0,
};
/* usage:cert-sign+dig-sig+encipher:critical */
- struct testTLSCertReq clientcert2req = {
+ static struct testTLSCertReq clientcert2req = {
NULL, NULL, "clientcert2.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1011,7 +1008,7 @@ mymain(void)
0, 0,
};
/* usage:cert-sign:not-critical */
- struct testTLSCertReq clientcert3req = {
+ static struct testTLSCertReq clientcert3req = {
NULL, NULL, "clientcert3.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1020,7 +1017,7 @@ mymain(void)
0, 0,
};
/* purpose:client:critical */
- struct testTLSCertReq clientcert4req = {
+ static struct testTLSCertReq clientcert4req = {
NULL, NULL, "clientcert4.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1029,7 +1026,7 @@ mymain(void)
0, 0,
};
/* purpose:client:not-critical */
- struct testTLSCertReq clientcert5req = {
+ static struct testTLSCertReq clientcert5req = {
NULL, NULL, "clientcert5.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1038,7 +1035,7 @@ mymain(void)
0, 0,
};
/* purpose:client+client:critical */
- struct testTLSCertReq clientcert6req = {
+ static struct testTLSCertReq clientcert6req = {
NULL, NULL, "clientcert6.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1047,7 +1044,7 @@ mymain(void)
0, 0,
};
/* purpose:client+client:not-critical */
- struct testTLSCertReq clientcert7req = {
+ static struct testTLSCertReq clientcert7req = {
NULL, NULL, "clientcert7.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1066,7 +1063,7 @@ mymain(void)
/* Bad clients */
/* usage:cert-sign:critical */
- struct testTLSCertReq clientcert8req = {
+ static struct testTLSCertReq clientcert8req = {
NULL, NULL, "clientcert8.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1075,7 +1072,7 @@ mymain(void)
0, 0,
};
/* purpose:client:critical */
- struct testTLSCertReq clientcert9req = {
+ static struct testTLSCertReq clientcert9req = {
NULL, NULL, "clientcert9.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1084,7 +1081,7 @@ mymain(void)
0, 0,
};
/* usage: none:critical */
- struct testTLSCertReq clientcert10req = {
+ static struct testTLSCertReq clientcert10req = {
NULL, NULL, "clientcert10.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1101,7 +1098,7 @@ mymain(void)
/* Expired stuff */
- struct testTLSCertReq cacertexpreq = {
+ static struct testTLSCertReq cacertexpreq = {
NULL, NULL, "cacert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, true,
@@ -1109,7 +1106,7 @@ mymain(void)
false, false, NULL, NULL,
0, 1,
};
- struct testTLSCertReq servercertexpreq = {
+ static struct testTLSCertReq servercertexpreq = {
NULL, NULL, "servercert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1117,7 +1114,7 @@ mymain(void)
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 1,
};
- struct testTLSCertReq clientcertexpreq = {
+ static struct testTLSCertReq clientcertexpreq = {
NULL, NULL, "clientcert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
@@ -1133,29 +1130,29 @@ mymain(void)
/* Not activated stuff */
- struct testTLSCertReq cacertnewreq = {
+ static struct testTLSCertReq cacertnewreq = {
NULL, NULL, "cacert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
- time(NULL)+(60*60), time(NULL)+(60*60*2),
+ 1, 2,
};
- struct testTLSCertReq servercertnewreq = {
+ static struct testTLSCertReq servercertnewreq = {
NULL, NULL, "servercert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
- time(NULL)+(60*60), time(NULL)+(60*60*2),
+ 1, 2,
};
- struct testTLSCertReq clientcertnewreq = {
+ static struct testTLSCertReq clientcertnewreq = {
NULL, NULL, "clientcert.pem", "UK",
"libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
- time(NULL)+(60*60), time(NULL)+(60*60*2),
+ 1, 2,
};
DO_CTX_TEST(true, cacertnewreq, servercertreq, true);
@@ -1168,7 +1165,7 @@ mymain(void)
/* When an altname is set, the CN is ignored, so it must be duplicated
* as an altname for it to match */
- struct testTLSCertReq servercertalt1req = {
+ static struct testTLSCertReq servercertalt1req = {
NULL, NULL, "servercert.pem", "UK",
"libvirt.org", "www.libvirt.org", "libvirt.org",
"192.168.122.1", "fec0::dead:beaf",
true, true, false,
@@ -1177,7 +1174,7 @@ mymain(void)
0, 0,
};
/* This intentionally doesn't replicate */
- struct testTLSCertReq servercertalt2req = {
+ static struct testTLSCertReq servercertalt2req = {
NULL, NULL, "servercert.pem", "UK",
"libvirt.org", "www.libvirt.org",
"wiki.libvirt.org", "192.168.122.1", "fec0::dead:beaf",
true, true, false,
@@ -1234,12 +1231,12 @@ mymain(void)
return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
}
+VIRT_TEST_MAIN(mymain)
+
#else
-static int
-mymain(int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED)
+int
+main(int argc ATTRIBUTE_UNUSED, char **argv ATTRIBUTE_UNUSED)
{
exit (EXIT_AM_SKIP);
}
#endif
-
-VIRT_TEST_MAIN(mymain)
--
1.7.4.4
10:39 a.m.
New subject: [libvirt] [PATCH] tests: fix compilation failures
On Fri, Jul 22, 2011 at 12:33:10PM -0600, Eric Blake wrote:
Even though gnutls is a hard-req for libvirt, and gnutls depends
on libtasn1, that does not mean that you have to have the libtasn1
development files installed. Skip the test rather than failing
compilation in that case.
With newer gcc, the test consumed too much stack space. Move
things to static storage to fix that.
* configure.ac (AC_CHECK_HEADERS): Check for libtasn1.h.
(HAVE_LIBTASN1): New automake conditional.
* tests/Makefile.am (virnettlsconvirnettlscontexttest_SOURCES)
(virnettlscontexttest_LDADD): Allow compilation without libtasn1.
* tests/virnettlscontexttest.c: Skip test if headers not present.
(struct testTLSCertReq): Alter time members.
(testTLSGenerateCert): Reflect the change.
(mymain): Reduce stack usage.
---
With this patch, I successfully skip the test if libtasn1-devel is
not installed, and successfully pass the test on a RHEL 6 machine.
I haven't yet tested on a F14 machine, where I heard reports from
Laine of a failure (possibly due to an older library), but we can
deal with that in a later patch.
I will push this under the build-breaker, once libvirt.org is back
up (or even sooner to an alternate repo, if the downtime gets to
be too painful).
configure.ac | 7 ++-
tests/Makefile.am | 10 +++-
tests/virnettlscontexttest.c | 109 ++++++++++++++++++++---------------------
3 files changed, 67 insertions(+), 59 deletions(-)
-#ifndef WIN32
+#if !defined WIN32 && HAVE_LIBTASN1_H
# include <libtasn1.h>
# include <gnutls/gnutls.h>
# include <gnutls/x509.h>
@@ -112,9 +112,10 @@ struct testTLSCertReq {
const char *keyPurposeOID1;
const char *keyPurposeOID2;
- /* if zero, then the current time will be used */
- time_t start;
- time_t expire;
+ /* zero for current time, or non-zero for hours from now */
+ int start_offset;
+ /* zero for 24 hours from now, or non-zero for hours from now */
+ int expire_offset;
};
@@ -160,13 +161,9 @@ testTLSGenerateCert(struct testTLSCertReq *req)
size_t size = sizeof(buffer);
char serial[5] = { 1, 2, 3, 4, 0 };
gnutls_datum_t der = { (unsigned char *)buffer, size };
- time_t start = req->start;
- time_t expire = req->expire;
-
- if (!start)
- start = time(NULL);
- if (!expire)
- expire = time(NULL) + (60*60*24);
+ time_t start = time(NULL) + (60*60*req->start_offset);
+ time_t expire = time(NULL) + (60*60*(req->expire_offset
+ ? req->expire_offset : 24));
This is actually a change in semantics introduced here. The
start/expire values were treated as absolute values, eg in
places we pass '1' for expiry time to indicate a time way
in the past. This has now become 1 hour into the future.
This is why the 3 expiry tests were broken.
I pushed the following change to make sure the expiry tests
have times in the past again
commit 567b8d69b97827da0e6e7145edb83ec0d7deff86
Author: Daniel P. Berrange <berrange(a)redhat.com>
Date: Mon Jul 25 16:18:56 2011 +0100
Fix TLS context tests with expired certs
commit 5283ea9b1d8a4b0f2fd6796bf60615aca7b6c3e6 changed the
semantics of the 'expire_offset' field in the test case struct
so that instead of being an absolute timestamp, it was a delta
relative to the current time. This broke the test cases which
were testing expiry of certificates, by putting the expiry
time into the future, instead of in the past.
Fix this by changing the expiry values to be negative, so that
the delta goes into the past again.
* virnettlscontexttest.c: Fix expiry tests
diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
index 043ccc2..dfc0ac4 100644
--- a/tests/virnettlscontexttest.c
+++ b/tests/virnettlscontexttest.c
@@ -1112,7 +1112,7 @@ mymain(void)
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
- 0, 1,
+ 0, -1,
};
static struct testTLSCertReq servercertexpreq = {
NULL, NULL, "servercert.pem", "UK",
@@ -1120,7 +1120,7 @@ mymain(void)
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
- 0, 1,
+ 0, -1,
};
static struct testTLSCertReq clientcertexpreq = {
NULL, NULL, "clientcert.pem", "UK",
@@ -1128,7 +1128,7 @@ mymain(void)
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
- 0, 1,
+ 0, -1,
};
DO_CTX_TEST(true, cacertexpreq, servercertreq, true);
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
2:36 p.m.
New subject: [libvirt] [PATCH] tests: fix compilation failures
On 07/25/2011 09:39 AM, Daniel P. Berrange wrote:
> (struct testTLSCertReq): Alter time members.
> (testTLSGenerateCert): Reflect the change.
> (mymain): Reduce stack usage.
> ---
>
>
> - /* if zero, then the current time will be used */
> - time_t start;
> - time_t expire;
> + /* zero for current time, or non-zero for hours from now */
> + int start_offset;
> + /* zero for 24 hours from now, or non-zero for hours from now */
> + int expire_offset;
> };
>
This is actually a change in semantics introduced here. The
start/expire values were treated as absolute values, eg in
places we pass '1' for expiry time to indicate a time way
in the past. This has now become 1 hour into the future.
This is why the 3 expiry tests were broken.
I pushed the following change to make sure the expiry tests
have times in the past again
+++ b/tests/virnettlscontexttest.c
@@ -1112,7 +1112,7 @@ mymain(void)
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
- 0, 1,
+ 0, -1,
Ah - while I fixed the future stamps, I forgot to fix the past stamps.
ACK to this change; however, I still find it odd that the start time is
now but the expire time is in the past. Instead, shouldn't we be using
something like start time of -2 and expire time of -1, so the start time
still comes before the expire time?
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
5:05 a.m.
New subject: [libvirt] [PATCH] tests: fix compilation failures
On Mon, Jul 25, 2011 at 01:36:23PM -0600, Eric Blake wrote:
On 07/25/2011 09:39 AM, Daniel P. Berrange wrote:
>>(struct testTLSCertReq): Alter time members.
>>(testTLSGenerateCert): Reflect the change.
>>(mymain): Reduce stack usage.
>>---
>>
>>
>>- /* if zero, then the current time will be used */
>>- time_t start;
>>- time_t expire;
>>+ /* zero for current time, or non-zero for hours from now */
>>+ int start_offset;
>>+ /* zero for 24 hours from now, or non-zero for hours from now */
>>+ int expire_offset;
>> };
>>
>
>This is actually a change in semantics introduced here. The
>start/expire values were treated as absolute values, eg in
>places we pass '1' for expiry time to indicate a time way
>in the past. This has now become 1 hour into the future.
>This is why the 3 expiry tests were broken.
>
>I pushed the following change to make sure the expiry tests
>have times in the past again
>
>+++ b/tests/virnettlscontexttest.c
>@@ -1112,7 +1112,7 @@ mymain(void)
> true, true, true,
> true, true, GNUTLS_KEY_KEY_CERT_SIGN,
> false, false, NULL, NULL,
>- 0, 1,
>+ 0, -1,
Ah - while I fixed the future stamps, I forgot to fix the past
stamps. ACK to this change; however, I still find it odd that the
start time is now but the expire time is in the past. Instead,
shouldn't we be using something like start time of -2 and expire
time of -1, so the start time still comes before the expire time?
Well we're not really testing the start time in this scenario, so
it doesn't really matter either way.
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
8:28 a.m.
On 07/22/2011 05:06 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange"<berrange(a)redhat.com>
When libvirtd starts it it will sanity check its own certs,
and before libvirt clients connect to a remote server they
will sanity check their own certs. This patch allows such
sanity checking to be skipped. There is no strong reason to
need to do this, other than to bypass possible libvirt bugs
in sanity checking, or for testing purposes.
libvirt.conf gains tls_no_sanity_certificate parameter to
go along with tls_no_verify_certificate. The remote driver
client URIs gain a no_sanity URI parameter
* daemon/test_libvirtd.aug, daemon/libvirtd.conf,
daemon/libvirtd.c, daemon/libvirtd.aug: Add parameter to
allow cert sanity checks to be skipped
* src/remote/remote_driver.c: Add no_sanity parameter to
skip cert checks
* src/rpc/virnettlscontext.c, src/rpc/virnettlscontext.h:
Add new parameter for skipping sanity checks independantly
of skipping session cert validation checks
---
daemon/libvirtd.aug | 1 +
daemon/libvirtd.c | 4 ++++
daemon/libvirtd.conf | 9 +++++++++
daemon/test_libvirtd.aug | 2 ++
src/remote/remote_driver.c | 15 +++++++++------
src/rpc/virnettlscontext.c | 36 +++++++++++++++++++++++-------------
src/rpc/virnettlscontext.h | 4 ++++
7 files changed, 52 insertions(+), 19 deletions(-)
ACK with nit fixed:
+# Flag to disable verification of our own server certificates
+#
+# When libvirtd starts it performs some sanity checks against
+# its own certificates.
+#
+# Default is to always sanity. Uncommenting this will disable
s/to always sanity/to always run sanity checks/
--
Eric Blake eblake(a)redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
4868
days inactive
4872
days old
8 comments
2 participants
participants (2)
-
Daniel P. Berrange -
Eric Blake