tests: added check to verify the tolerance of broken C_GetAttributes

That is, test gnutls_pkcs11_obj_list_import_url4() when importing
private keys from tokens that return CKR_OK on sensitive objects,
and tokens that return CKR_ATTRIBUTE_SENSTIVE.

Relates #108

4 files changed, 169 insertions, 2 deletions

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 967d48eae7..b61d322960 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -106,9 +106,12 @@ pkcs11_get_exts_DEPENDENCIES = libpkcs11mock1.la libutils.la
 pkcs11_get_raw_issuer_exts_SOURCES = pkcs11/pkcs11-get-raw-issuer-exts.c
 pkcs11_get_raw_issuer_exts_DEPENDENCIES = libpkcs11mock1.la libutils.la
 
+pkcs11_import_url_privkey_SOURCES = pkcs11/pkcs11-import-url-privkey.c
+pkcs11_import_url_privkey_DEPENDENCIES = libpkcs11mock1.la libutils.la
+
 ctests += pkcs11-cert-import-url-exts pkcs11-get-exts pkcs11-get-raw-issuer-exts \
 	pkcs11/pkcs11-chainverify pkcs11/pkcs11-get-issuer pkcs11/pkcs11-is-known \
-	pkcs11/pkcs11-combo
+	pkcs11/pkcs11-combo pkcs11-import-url-privkey
 
 endif
 endif
diff --git a/tests/pkcs11/pkcs11-import-url-privkey.c b/tests/pkcs11/pkcs11-import-url-privkey.c
new file mode 100644
index 0000000000..3f76c2ca0d
--- /dev/null
+++ b/tests/pkcs11/pkcs11-import-url-privkey.c
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2016 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/x509-ext.h>
+
+#include "utils.h"
+#include "pkcs11-mock-ext.h"
+
+/* Tests the private key import for sensitive keys in the common case and in
+ * some problematic cases. */
+
+#ifdef _WIN32
+# define P11LIB "libpkcs11mock1.dll"
+#else
+# include <dlfcn.h>
+# define P11LIB "libpkcs11mock1.so"
+#endif
+
+void doit(void)
+{
+	int ret;
+	const char *lib;
+	gnutls_pkcs11_obj_t *obj_list;
+	unsigned int obj_list_size = 0;
+	unsigned int i;
+
+	ret = global_init();
+	if (ret != 0) {
+		fail("%d: %s\n", ret, gnutls_strerror(ret));
+		exit(1);
+	}
+
+	lib = getenv("P11MOCKLIB1");
+	if (lib == NULL)
+		lib = P11LIB;
+
+	ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
+	if (ret != 0) {
+		fail("%d: %s\n", ret, gnutls_strerror(ret));
+		exit(1);
+	}
+
+	ret = gnutls_pkcs11_add_provider(lib, NULL);
+	if (ret != 0) {
+		fail("%d: %s\n", ret, gnutls_strerror(ret));
+		exit(1);
+	}
+
+	ret = gnutls_pkcs11_obj_list_import_url2(&obj_list, &obj_list_size, "pkcs11:", GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY, 0);
+	if (ret < 0) {
+		fail("%d: %s\n", ret, gnutls_strerror(ret));
+		exit(1);
+	}
+
+	for (i=0;i<obj_list_size;i++)
+		gnutls_pkcs11_obj_deinit(obj_list[i]);
+	gnutls_free(obj_list);
+	obj_list = NULL;
+	obj_list_size = 0;
+
+#ifndef _WIN32
+	{
+		void *dl;
+		unsigned int *pflags;
+
+		dl = dlopen(lib, RTLD_NOW);
+		if (dl == NULL) {
+			fail("could not dlopen %s\n", lib);
+			exit(1);
+		}
+
+		pflags = dlsym(dl, "pkcs11_mock_flags");
+		if (pflags == NULL) {
+			fail("could find pkcs11_mock_flags\n");
+			exit(1);
+		}
+
+		*pflags = MOCK_FLAG_BROKEN_GET_ATTRIBUTES;
+
+		ret = gnutls_pkcs11_obj_list_import_url2(&obj_list, &obj_list_size, "pkcs11:", GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY, 0);
+		if (ret < 0) {
+			fail("%d: %s\n", ret, gnutls_strerror(ret));
+			exit(1);
+		}
+
+		for (i=0;i<obj_list_size;i++)
+			gnutls_pkcs11_obj_deinit(obj_list[i]);
+		gnutls_free(obj_list);
+		obj_list = NULL;
+		obj_list_size = 0;
+	}
+#endif
+
+	if (debug)
+		printf("done\n\n\n");
+
+	gnutls_global_deinit();
+}
diff --git a/tests/pkcs11/pkcs11-mock-ext.h b/tests/pkcs11/pkcs11-mock-ext.h
new file mode 100644
index 0000000000..8b66b189bc
--- /dev/null
+++ b/tests/pkcs11/pkcs11-mock-ext.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifndef PKCS11_MOCK_EXT_H
+# define PKCS11_MOCK_EXT_H
+
+/* This flag instructs the module to return CKR_OK on sensitive
+ * objects */
+#define MOCK_FLAG_BROKEN_GET_ATTRIBUTES 1
+
+#endif
diff --git a/tests/pkcs11/pkcs11-mock.c b/tests/pkcs11/pkcs11-mock.c
index c10ccc1185..de265bf5d0 100644
--- a/tests/pkcs11/pkcs11-mock.c
+++ b/tests/pkcs11/pkcs11-mock.c
@@ -13,10 +13,12 @@
  *  Please contact JWC s.r.o. at <info@pkcs11interop.net> for more details.
  */
 
-
 #include "pkcs11-mock.h"
+#include "pkcs11-mock-ext.h"
 #include <stdlib.h>
 
+unsigned int pkcs11_mock_flags = 0;
+
 /* This is a very basic mock PKCS #11 module that will return a given fixed
  * certificate, and public key for all searches. It will also provide a
  * CKO_X_CERTIFICATE_EXTENSION so that it can be used as a p11-kit trust
@@ -964,6 +966,9 @@ CK_DEFINE_FUNCTION(CK_RV, C_GetAttributeValue)(CK_SESSION_HANDLE hSession, CK_OB
 			else if (PKCS11_MOCK_CK_OBJECT_HANDLE_PRIVATE_KEY == hObject)
 			{
 				pTemplate[i].ulValueLen = (CK_ULONG) -1;
+				if (!(pkcs11_mock_flags & MOCK_FLAG_BROKEN_GET_ATTRIBUTES)) {
+					return CKR_ATTRIBUTE_SENSITIVE;
+				}
 			}
 			else
 			{