10:39 a.m.
On Fri, Jul 22, 2011 at 12:33:10PM -0600, Eric Blake wrote:
Even though gnutls is a hard-req for libvirt, and gnutls depends
on libtasn1, that does not mean that you have to have the libtasn1
development files installed. Skip the test rather than failing
compilation in that case.
With newer gcc, the test consumed too much stack space. Move
things to static storage to fix that.
* configure.ac (AC_CHECK_HEADERS): Check for libtasn1.h.
(HAVE_LIBTASN1): New automake conditional.
* tests/Makefile.am (virnettlsconvirnettlscontexttest_SOURCES)
(virnettlscontexttest_LDADD): Allow compilation without libtasn1.
* tests/virnettlscontexttest.c: Skip test if headers not present.
(struct testTLSCertReq): Alter time members.
(testTLSGenerateCert): Reflect the change.
(mymain): Reduce stack usage.
---
With this patch, I successfully skip the test if libtasn1-devel is
not installed, and successfully pass the test on a RHEL 6 machine.
I haven't yet tested on a F14 machine, where I heard reports from
Laine of a failure (possibly due to an older library), but we can
deal with that in a later patch.
I will push this under the build-breaker, once libvirt.org is back
up (or even sooner to an alternate repo, if the downtime gets to
be too painful).
configure.ac | 7 ++-
tests/Makefile.am | 10 +++-
tests/virnettlscontexttest.c | 109 ++++++++++++++++++++---------------------
3 files changed, 67 insertions(+), 59 deletions(-)
-#ifndef WIN32
+#if !defined WIN32 && HAVE_LIBTASN1_H
# include <libtasn1.h>
# include <gnutls/gnutls.h>
# include <gnutls/x509.h>
@@ -112,9 +112,10 @@ struct testTLSCertReq {
const char *keyPurposeOID1;
const char *keyPurposeOID2;
- /* if zero, then the current time will be used */
- time_t start;
- time_t expire;
+ /* zero for current time, or non-zero for hours from now */
+ int start_offset;
+ /* zero for 24 hours from now, or non-zero for hours from now */
+ int expire_offset;
};
@@ -160,13 +161,9 @@ testTLSGenerateCert(struct testTLSCertReq *req)
size_t size = sizeof(buffer);
char serial[5] = { 1, 2, 3, 4, 0 };
gnutls_datum_t der = { (unsigned char *)buffer, size };
- time_t start = req->start;
- time_t expire = req->expire;
-
- if (!start)
- start = time(NULL);
- if (!expire)
- expire = time(NULL) + (60*60*24);
+ time_t start = time(NULL) + (60*60*req->start_offset);
+ time_t expire = time(NULL) + (60*60*(req->expire_offset
+ ? req->expire_offset : 24));
This is actually a change in semantics introduced here. The
start/expire values were treated as absolute values, eg in
places we pass '1' for expiry time to indicate a time way
in the past. This has now become 1 hour into the future.
This is why the 3 expiry tests were broken.
I pushed the following change to make sure the expiry tests
have times in the past again
commit 567b8d69b97827da0e6e7145edb83ec0d7deff86
Author: Daniel P. Berrange <berrange(a)redhat.com>
Date: Mon Jul 25 16:18:56 2011 +0100
Fix TLS context tests with expired certs
commit 5283ea9b1d8a4b0f2fd6796bf60615aca7b6c3e6 changed the
semantics of the 'expire_offset' field in the test case struct
so that instead of being an absolute timestamp, it was a delta
relative to the current time. This broke the test cases which
were testing expiry of certificates, by putting the expiry
time into the future, instead of in the past.
Fix this by changing the expiry values to be negative, so that
the delta goes into the past again.
* virnettlscontexttest.c: Fix expiry tests
diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
index 043ccc2..dfc0ac4 100644
--- a/tests/virnettlscontexttest.c
+++ b/tests/virnettlscontexttest.c
@@ -1112,7 +1112,7 @@ mymain(void)
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
- 0, 1,
+ 0, -1,
};
static struct testTLSCertReq servercertexpreq = {
NULL, NULL, "servercert.pem", "UK",
@@ -1120,7 +1120,7 @@ mymain(void)
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
- 0, 1,
+ 0, -1,
};
static struct testTLSCertReq clientcertexpreq = {
NULL, NULL, "clientcert.pem", "UK",
@@ -1128,7 +1128,7 @@ mymain(void)
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
- 0, 1,
+ 0, -1,
};
DO_CTX_TEST(true, cacertexpreq, servercertreq, true);
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|